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I. Introduction 

On April 11, 201 1 , Paul Ceglia filed an Amended Complaint seeking a share of Facebook, Inc. 
("Facebook"). Mr. Ceglia based his claim on a purported contract between Mr. Ceglia and Mark 
Zuckerberg (hereinafter, the "Work for Hire Document"). The Work for Hire Document was attached to 
the Amended Complaint as Exhibit A. In addition, the Amended Complaint included excerpts of purported 
emails between Mr. Ceglia and Mr. Zuckerberg (hereinafter, the "Purported Emails"). 

On July 1 , 201 1 , the Honorable Leslie G. Foschio entered an Order for expedited discovery requiring Mr. 
Ceglia to "produce . . . the following electronic assets: (1) the native electronic version of the [Work for 
Hire Document] and all electronic copies of th[at] contract . . . ; (2) the original, native electronic files 
consisting of or containing the [Purported Emails] and all electronic copies of the [Purported [E]mails; and 
(3) all computer and electronic media in [Mr. Ceglia's] possession, custody, or control . . . ." (Order, Ceglia 
v. Zuckerberg, et al., No. 1 :1 0-cv-00569-RJA, July 1 , 201 1 , at p. 2). 

The Court also issued an Electronic Asset Inspection Protocol (the "Protocol") governing the analysis of 
the electronic assets produced by Mr. Ceglia. Pursuant to the Protocol, Stroz Friedberg, LLC ("Stroz 
Friedberg") was to create "forensically-sound copies" of the electronic assets produced by Mr. Ceglia. 
(Electronic Asset Inspection Protocol, Ceglia v. Zuckerberg, etal., No. 1 :10-cv-00569-RJA, July 1, 2011, 
at p. 2). Stroz Friedberg then was authorized to search those electronic assets "in order to identify only 
documents, data, fragments, and artifacts that reasonably appear to be related to the authenticity of the 
[Work for Hire Document] and the [Purported Emails]." (Id.). Stroz Friedberg also received additional 
data pursuant to subpoenas or other Orders of the Court, including various sources of email data. This 
data also was analyzed by Stroz Friedberg. 

This report is a summary of Stroz Friedberg's findings regarding the authenticity of the Work for Hire 
Document and the Purported Emails based on its analysis of the media produced by Mr. Ceglia pursuant 
to the Protocol and its analysis of the other data received as part of expedited discovery. This report is 
not intended to detail each and every aspect of Stroz Friedberg's work in this engagement. Stroz 
Friedberg reserves the right to supplement or modify this report based on any new or additional 
information not previously examined, or brought to its attention or based on any new or additional 
allegations made by Mr. Ceglia. 
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II. Executive Summary 

Stroz Friedberg found direct and compelling digital forensic evidence that the documents relied upon by 
Mr. Ceglia to support his claim are forged. Stroz Friedberg also found what it believes to be the authentic 
contract between Mr. Ceglia and Mr. Zuckerberg. That contract contains no references to Facebook. As 
described more fully in this report, Stroz Friedberg made the following findings bearing on the authenticity 
of the Work for Hire Document and the Purported Emails: 

• Stroz Friedberg did not find any exact copies of the Work for Hire Document on the hundreds of 
pieces of media produced by Mr. Ceglia, including three computers, three hard drives, 174 floppy 
disks, and 1,087 CDs (hereinafter, the "Ceglia Media"). 

• Stroz Friedberg did find a signed copy of an April 28, 2003 contract between Mr. Ceglia and Mr. 
Zuckerberg, entitled "STREET FAX," concerning Mr. Zuckerberg's work on the StreetFax project 
(hereinafter, the "StreetFax Contract"). The StreetFax Contract differs substantially from the 
Work for Hire Document; the StreetFax Contract concerns only Mr. Zuckerberg's work on the 
StreetFax project and includes no references to Facebook. 

• The StreetFax Contract was found as two image files, each file being a scanned copy of one 
page of the two-page contract. The image file of the second page of the StreetFax Contract was 
saved to a computer produced by Mr. Ceglia on March 3, 2004 at 10:35:21 a.m., and then sent 
out via email approximately two minutes later at 1 0:37:1 5 a.m. The image file of the first page of 
the StreetFax Contract was saved to a computer produced by Mr. Ceglia on March 3, 2004 at 

1 0:38:35 a.m., and then sent out via email less than one minute later at 1 0:39:1 1 a.m. These 
images were attached to two emails from ceglia@adelphia.net to Jim Kole of Sidley Austin Brown 
& Wood LLP ("Sidley Austin") (hereinafter, the "StreetFax Emails"). The first of the two emails 
reads: "Hi Jim, Hope all is well, I am at 727 490 5751 when your ready. Ill send page two next I 
should be here for the next hour. Paul." The second of the two emails includes an attachment 
but has no text in the body of the email. 

• Sidley Austin also produced copies of the StreetFax Emails, which it has maintained since March 
3, 2004. Stroz Friedberg determined that the content of the emails and the attached copy of the 
StreetFax Contract produced by Sidley Austin are the same as the content of the emails and the 
attached copy of the StreetFax Contract found on the Ceglia Media. 

• Stroz Friedberg identified seven unsigned electronic documents on the Ceglia Media that are 
variants of the Work for Hire Document. All of these electronic documents were backdated to 
appear as if they were created at earlier dates. They appear to be part of an effort to create a 
fraudulent contract. 
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• Stroz Friedberg did not find any of the Purported Emails in native file format, that is to say, as files 
in an email format. They do not exist in native format on any of the Ceglia Media or in any of Mr. 
Ceglia's webmail accounts examined by Stroz Friedberg. 

• Stroz Friedberg did identify the Microsoft Word documents into which Mr. Ceglia claims to have 
copied-and-pasted the text of the Purported Emails. All of these Word documents were 
backdated to appear as if they were created at earlier dates. 

• The Purported Emails themselves, which Mr. Ceglia has proffered as authentic communications 
with Mr. Zuckerberg, are fabricated. Many of the Purported Emails reflect the wrong time zone. 
For example, all of the Purported Emails purportedly sent from October 26, 2003 to April 4, 2004 
contain the "-0400" time zone stamp that reflects Eastern Daylight Time. However, Eastern 
Daylight Time was not in effect during this time. There is no place in the Continental United 
States from which Mr. Ceglia could have sent these Purported Emails with an accurate "-0400" 
time zone stamp. 

• The Purported Emails have formatting differences in the email headers that are inconsistent with 
Mr. Ceglia's explanation that he copied-and-pasted the emails into Word documents. These 
formatting inconsistencies include differences in the number of spaces following the colon in the 
"To" and "From" fields and the way in which the word "Tuesday" is abbreviated. These formatting 
differences indicate that the Purported Emails were typed or edited manually and were not solely 
the result of a copy-and-paste operation. 

• Stroz Friedberg found evidence that a hex editor was used on documents found on the Ceglia 

Media REDACTED 

Hex editors can be used to create 
electronic forgeries because they allow the manipulation of data at a level that makes traditional 
digital forensic analysis of the fraudulent change to the document more difficult, if not impossible, 
to detect. 

• Stroz Friedberg found substantial evidence of possible spoliation, including multiple reinstallations 
of the Windows operating system during the pendency of this litigation on the computer that 
contained the StreetFax Contract. Stroz Friedberg also found evidence that relevant files were 
deleted and overwritten in February 201 1 . In addition, Stroz Friedberg found evidence that email 
data was deleted from the recently disclosed getzuck@gmail.com account. 

• Stroz Friedberg identified substantial evidence of the existence of several pieces of media that 
Mr. Ceglia did not turn over, identify, or otherwise account for, some of which appear to have 
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contained versions of a contract between Mr. Ceglia and Mr. Zuckerberg, namely: "Zuckerberg 
Contract page1.tif" and "Zuckerberg Contract page2.tif." Three pieces of undisclosed media were 
used during the pendency of this litigation. 

• There is no digital forensic evidence on the Ceglia Media supporting a conclusion that the Work 
for Hire Document or the Purported Emails are authentic documents dating from 2003 and 2004. 
To the contrary, the digital forensic evidence strongly indicates that these documents were 
fabricated by Mr. Ceglia at a later date. 
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III. Stroz Friedberg Background 

A. Company Information 

Founded in 2000, Stroz Friedberg is an international firm specializing in critical areas of digital risk 
management, including digital forensics, electronic discovery, data breach and cybercrime response, and 
business intelligence services and investigations. Stroz Friedberg's management includes former federal 
and state prosecutors and former law enforcement officers with both government and private-sector 
experience in traditional and cyber-based investigations, digital forensics, data preservation and analysis, 
infrastructure protection, and electronic discovery. Many of its staff of digital forensic examiners, 
electronic security professionals, electronic discovery specialists, and private investigators joined Stroz 
Friedberg following careers in law enforcement, the intelligence community, and consulting. 

B. Biographies 

This report was prepared by Bryan J. Rose, Michael F. McGowan, and Jason A. Novak, under the 
direction and supervision of Eric M. Friedberg. 

1 . Eric M. Friedberg 

This investigation was supervised and directed by Eric M. Friedberg. Mr. Friedberg is Co-President of 
Stroz Friedberg. He has participated in and supervised hundreds of digital forensic examinations over his 
eleven plus years with Stroz Friedberg, both in the context of litigation-related disputes and responses to 
cybercrime. He also has participated in and supervised many of the firm's electronic forgery matters, 
including disputes over the authenticity of contracts, emails, movie scripts, and memoranda. In addition, 
Mr. Friedberg has published an article and lectured on electronic forgeries. Prior to joining Stroz 
Friedberg, Mr. Friedberg was an Assistant United States Attorney with the United States Attorney's Office 
for the Eastern District of New York from 1989 to 2000, where he acted at various times as the Office's 
Chief of Narcotics and the District's lead cybercrime prosecutor. A copy of Mr. Friedberg's C.V. is 
attached to this report as Exhibit A. 

2. Bryan J. Rose 

Bryan J. Rose is a Managing Director at Stroz Friedberg and the head of its New York office. Mr. Rose 
manages matters in the areas of digital forensics, electronic discovery, and cybercrime response and 
supervises digital forensic examiners in the performance of their jobs. Prior to joining Stroz Friedberg, Mr. 
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Rose served as an Assistant United States Attorney in the Eastern District of New York and as an 
Assistant Attorney General in the State of Illinois. He also served as a law clerk for The Honorable Joel 
M. Flaum of the United States Court of Appeals for the Seventh Circuit. Mr. Rose is a graduate of the 
University of Virginia School of Law, where he was named a Hardy Cross Dillard Scholar and served as 
Editor-in-Chief of the Virginia Law Review. A copy of Mr. Rose's C.V. is attached to this report as Exhibit 
B. 

3. Michael F. McGowan 

Michael F. McGowan is a Director of Digital Forensics at Stroz Friedberg and co-manages Stroz 
Friedberg's digital forensic operations. Mr. McGowan helped lead the development of Stroz Friedberg's 
expertise in detecting the backdating and forgery of electronic documents. He has gained significant 
expertise through experience, research, and training in detecting electronic forgeries and has conducted 
digital forensic examinations in significant cases hinging on the authenticity of proffered electronic 
documents. In many cases, Mr. McGowan has been able to find critical evidence regarding the 
authenticity of electronic documents that proved case-dispositive. Mr. McGowan has provided trial and 
hearing testimony on a number of occasions and has been admitted as an expert in digital forensics in 
federal and state court, including on behalf of the United States Department of Justice in connection with 
one of the Enron Task Force prosecutions. A copy of Mr. McGowan's C.V. is attached to this report as 
Exhibit C. 

4. Jason A. Novak 

Jason A. Novak is an Assistant Director of Digital Forensics at Stroz Friedberg. Mr. Novak has conducted 
hundreds of digital forensic preservations and analyses, including work to identify evidence of spoliation, 
backdating, unauthorized access, the theft of intellectual property, and the interception of third-party data. 
Mr. Novak has provided sworn testimony in support of his analyses, as well as reports to domestic and 
international regulatory agencies. He holds a Bachelor of Arts degree in Political Science with a minor in 
Computer Science from the University of Chicago and is an EnCase Certified Examiner. A copy of Mr. 
Novak's C.V. is attached to this report as Exhibit D. 
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IV. Evidence Considered 

Pursuant to the July 1 , 201 1 Order, Stroz Friedberg collected digital media made available by Mr. Ceglia 
through his agents between July 1 5, 201 1 and July 22, 201 1 , in three different locations: Chicago, Illinois; 
Sarasota, Florida; and Buffalo, New York. Stroz Friedberg inspected the data on the following media for 
analysis according to the terms of the Court-ordered Protocol: 

• A Compaq Presario SR541 3WM desktop computer with a 250 gigabyte hard drive, which Stroz 
Friedberg imaged in Buffalo, New York, on July 1 5, 201 1 . 

• An eMachines ET1 1 61 -05 desktop computer with a 1 60 gigabyte hard drive, which Stroz 
Friedberg imaged in Buffalo, New York, on July 19, 2011. 

• A Toshiba Satellite L305-55968 laptop computer with a 320 gigabyte hard drive, which Stroz 
Friedberg imaged in Chicago, Illinois, on July 1 5, 201 1 . 

• A 200 gigabyte Maxtor Personal Storage 3200 external hard drive, which Stroz Friedberg imaged 
in Sarasota, Florida, on July 1 5, 201 1 . An external hard drive is a drive designed to be used and 
connected to a computer externally, without being physically inserted into the computer's case. 

• A 120 gigabyte Seagate ST3120025A internal hard drive, which Stroz Friedberg imaged in 
Sarasota, Florida, on July 15, 2011 (hereinafter, the "Seagate Hard Drive"). This hard drive was 
produced as a standalone drive, without the computer in which it had once resided. An internal 
hard drive is a drive that is designed to be used within a computer, not as an external device. 

• A 500 gigabyte Western Digital internal hard drive, which Stroz Friedberg preserved in Chicago, 
Illinois, on July 1 8, 201 1 . This hard drive also was produced as a standalone drive. Upon 
examination, Stroz Friedberg determined that this hard drive contained a series of E01 files, 
which is a forensic image file format, meaning that the data on this hard drive was a forensic 
image of another piece of digital media. Stroz Friedberg determined that this Western Digital 
hard drive contained a forensic copy of the Seagate Hard Drive, made on March 29, 201 1 by an 
expert retained by Mr. Ceglia (hereinafter, the "Forensic Image Created by Plaintiffs Expert"). 

• 1 74 floppy disks, five of which were made available to Stroz Friedberg in Sarasota, Florida, on 
July 1 5, 201 1 and 1 69 of which were made available to Stroz Friedberg in Chicago, Illinois, 
between July 1 5, 201 1 and July 22, 201 1 . 

• 1 ,087 CDs, twelve of which were made available to Stroz Friedberg in Sarasota, Florida, on July 

1 5, 201 1 and 1 ,075 of which were made available to Stroz Friedberg in Chicago, Illinois, between 
July 15, 2011 and July 22, 2011. 
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• One DVD, which was made available to Stroz Friedberg in Chicago, Illinois, between July 15, 
2011 and July 22, 2011. 



Using widely-accepted digital forensic techniques and procedures, digital forensic personnel from Stroz 
Friedberg made bit-for-bit, verified forensic copies or images of: the hard drive within the Compaq 
Presario desktop computer; the hard drive within the eMachines desktop computer; the hard drive within 
the Toshiba Satellite laptop computer; the Maxtor external hard drive; the Seagate Hard Drive; 173 of the 
174 floppy disks; and 393 of the 1 ,087 CDs. The digital forensic copying process captured the entire 
contents of each piece of media, including the active user-accessible files, the deleted files, and the 
unallocated space, which may contain deleted content. Because the Forensic Image Created by 
Plaintiff's Expert is a forensic image file, Stroz Friedberg used a forensically-sound copy method to copy 
the forensic image file on that drive to preservation media. 

During the preservation process, Stroz Friedberg did not make copies of the following pieces of the 
Ceglia Media: 

• One floppy disk, on which the data could not be accessed; 

• 81 CDs that could not be imaged for technical reasons; 1 

• 613 CDs that were not imaged because, after review, they did not appear to contain data relevant 
to the authenticity of Work for Hire Document or the Purported Emails, which were the subject of 
the review authorized by the Court; and 

• One DVD that could not be imaged for technical reasons. 

Stroz Friedberg also received additional data pursuant to subpoenas or other Orders of the Court, 
including various sources of email data. 



1 When Stroz Friedberg encountered technical obstacles copying a piece of media, it made efforts to acquire as much 
information as possible about the data. For four of the CDs that could not be imaged, Stroz Friedberg made file 
listings of their contents. For one of the CDs, a preservation of the logical active files was made. One of the CDs 
could not be read because an evidence number label from one of Mr. Ceglia's experts had been placed on the back 
of the CD, making it unreadable. Another one of the CDs could not be imaged and a partial logical acquisition was 
made of its contents. 
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V. Stroz Friedberg's Process and Procedures 

Stroz Friedberg conducted its analysis of the Ceglia Media pursuant to the Protocol issued by the Court 
on July 1 , 201 1 (Doc. No. 85). Stroz Friedberg searched and analyzed the Ceglia Media "to identify only 
documents, data, fragments, and artifacts that reasonably appealed] to be related to the authenticity of 
the [Work for Hire Document] attached to the Amended Complaint and the [Purported [E]mails described 
in the Amended Complaint." (Protocol at p. 2). The documents, data, fragments, and artifacts found by 
Stroz Friedberg that reasonably appeared to be related to the authenticity of the Work for Hire Document 
or the Purported Emails first were produced to Mr. Ceglia's attorneys for a privilege review. The material 
was turned over to attorneys from Gibson Dunn only if no privilege objection was raised, an asserted 
privilege objection was withdrawn by Mr. Ceglia or his attorneys, or an assertion of privilege was 
overruled by the Court. Stroz Friedberg has followed the terms of the Protocol for all data found on the 
Ceglia Media and any other data subject to the Protocol during its analysis, including the procedures for 
privilege review and production set forth above and the maintenance of a search log. 

In addition, Stroz Friedberg conducted an analysis of emails produced by Sidley Austin in response to a 
Court-authorized subpoena, as well as other materials produced pursuant to subpoenas or consent, 
including the contents of various webmail accounts belonging to Mr. Ceglia, or data produced by or 
collected from Mr. Ceglia's agents or experts. This material was handled pursuant to the Protocol if 
applicable, or according to the terms of the applicable Court Order governing the production of the data. 

During this analysis, Stroz Friedberg employed a methodology tailored to the particular facts of this case. 
Stroz Friedberg's methodology included: (1 ) conducting keyword and other searches of the digital 
forensic copies of the Ceglia Media and other data, including webmail accounts, to identify responsive 
documents or fragments of documents; (2) manually reviewing the documents containing keyword hits, 
certain unsearchable file types, such as image files with no text, and other documents to determine 
whether they were relevant to the authenticity of the Work for Hire Document or the Purported Emails; 
and (3) reviewing the digital forensic copies of the Ceglia Media for digital forensic artifacts relevant to the 
authenticity of the Work for Hire Document or the Purported Emails. 

Stroz Friedberg's methodology was designed to identify documents or forensic artifacts relevant to the 
authenticity of the Work for Hire Document and the Purported Emails. This methodology would have 
identified any and all copies or versions of the Work for Hire Document, any and all copies or versions of 
the StreetFax Contract, any and all copies of the Purported Emails, and other email correspondence 
between Mr. Ceglia and Mr. Zuckerberg. 
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VI. Work for Hire Document 

A. The Work for Hire Document Was Not Found on the Ceglia Media 

No exact copies of the Work for Hire Document were found on the Ceglia Media, which comprise 
hundreds of pieces of media, including computers, hard drives, floppy disks, and CDs. 2 Stroz Friedberg 
used a methodology that would have identified any copies of the Work for Hire Document on the Ceglia 
Media if they had been present. 

Stroz Friedberg did obtain a copy of the Work for Hire Document directly from Paul Argentieri, counsel for 
Mr. Ceglia, pursuant to a Court Order. This copy was attached to a June 27, 201 email message 3 from 
Mr. Ceglia to Mr. Argentieri. This means that Mr. Ceglia possessed the Work for Hire Document in 
electronic form on June 27, 201 0, three days before the lawsuit was filed. Furthermore, in its analysis of 
Mr. Ceglia's Gmail (paulceglia@gmail.com) account, Stroz Friedberg identifed a June 29, 2010 email 
from Mr. Ceglia to Karin Peterson, a former StreetFax employee, with a copy of the Work for Hire 
Document attached. 

Stroz Friedberg would, therefore, have expected to find a copy of the Work for Hire Document - sent by 
Mr. Ceglia to Mr. Argentieri on June 27, 201 0, and to Ms. Peterson on June 29, 201 - somewhere on 
the Ceglia Media. Again, it did not. 



2 Stroz Friedberg did identify a March 201 1 document that contains various litigation documents, including a copy of 
the filed version of the Work for Hire Document and a full transcript of the July 20, 201 oral arguments in this matter. 

3 Unless otherwise specified, the dates and times referred to in this report are represented in Eastern Daylight or 
Standard Time. 
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VII. The StreetFax Contract (Ceglia Media) 

A. The StreetFax Contract Was Found on Two Different Ceglia Hard Drives 

As noted above, Stroz Friedberg searched for and did not find any exact copies of the Work for Hire 
Document on the Ceglia Media. However, Stroz Friedberg did find a copy of the StreetFax Contract on 
two hard drives produced by Mr. Ceglia: the Seagate Hard Drive and the Forensic Image Created by 
Plaintiff's Expert, which is a forensic image of the Seagate Hard Drive. 4 

1 . The StreetFax Contract Was Found on Two Hard Drives 

During its analysis of the Seagate Hard Drive and the Forensic Image Created by Plaintiffs Expert, Stroz 
Friedberg found references to Outlook Express email, a common Microsoft email client. 5 

Stroz Friedberg examined the Outlook Express email to determine if any of the Outlook Express email 
messages were relevant to the authenticity of the Work for Hire Document or the Purported Emails. 
Among the Outlook Express email was a DBX file named "Sent Items. dbx," which typically contains 
copies of emails sent from the email client. A DBX file is a standard email container file that stores 
multiple email messages and their attachments, similar to a Microsoft Outlook PST file or a Lotus Notes 
NSF file. 

Upon examination, only two of the emails were determined to be relevant to the authenticity of the Work 
for Hire Document. A redacted screenshot of the relevant contents of the "Sent Items. dbx" file found on 
the Seagate Hard Drive and the Forensic Image Created by Plaintiffs Expert is below. 



4 The Forensic Image Created by Plaintiffs Expert was created on March 29, 201 1 and subsequently preserved by 
Stroz Friedberg on July 18, 201 1 . The Seagate Hard Drive itself continued to be used after March 29, 201 1 and was 
imaged by Stroz Friedberg on July 1 5, 201 1 . 

5 An email client is a type of software program used to access email. 
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Fig. 1 : Redacted Screenshot of "Sent Items. dbx" File 



The two emails contained in the "Sent Items. dbx" file that were determined to be relevant to the 
authenticity of the Work for Hire Document, shown in the screenshot above, had the following subject 
lines: "page 1 of 2 for Streetfax contract w mark" and "2 of 2 for streetfax contract." The StreetFax Emails 
were sent from "ceglia@adelphia.net" to "jkole@sidley.com." The first of the two emails reads: "Hi Jim, 
Hope all is well, I am at 727 490 5751 when your ready. Ill send page two next I should be here for the 
next hour. Paul." The second of the two emails includes an attachment but has no text in the body of the 
email. 
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Screenshots showing the StreetFax Emails are below: 



I page 1 of 2 for StreetfaK contract w mark 




-inlx 


File Edit View Tools Message Help 




Reply Reply All Forward 


Print Delete 


Q O 

Previous Next 


Addresses 



From: vera ceglia 

Date: Wednesday, March 03, 2004 10:37 AM 

To: jkole@sidley.com 

Subject: page 1 of 2 for 5treetfax contract w mark 



Attach: |ftj, 5can0002.tif (970 KB) 



Hi Jim, Hope all is well, I am at 727 490 5751 when your ready. Ill send page two 
next I should be here for the next hour. Paul 



Fig. 2: Screenshot of the First StreetFax Email 



I 2 of 2 for StreetfaK contract 



| File Edit View Tools Message Help 



Reply Reply All Forward 



Print 



X 

Delete 



Previous 



Next 



Addresses 



From: 
Date: 
To: 

Subject: 
Attach: 



vera ceglia 

Wednesday, March 03, 2004 10:39 AM 

jkole@sidley.com 

2 of 2 for streetfax contract 



^B. j5can0001 .tif (947 KB) 



Fig. 3: Screenshot of the Second StreetFax Email 
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Both of the StreetFax Emails contain one-page attachments in Tagged Image File Format, commonly 
known as TIFF images. TIFF images are a standard image format in which the document itself is not a 
text-based document like a Word document, but rather is a "picture" that includes the document and text 
in a graphic format. 

Upon examination, Stroz Friedberg determined that the two TIFF images attached to the StreetFax 
Emails were each one page of the two-page StreetFax Contract. The TIFF image attachments appear to 
be scanned documents and are of low-quality resolution. Copies of the StreetFax Emails and attached 
StreetFax Contract, 6 as found on the Ceglia Media, are attached as Exhibits E, F, G, and H. 

In examining the StreetFax Contract, Stroz Friedberg noted that it differed substantially from the Work for 
Hire Document relied on by Mr. Ceglia in this lawsuit. One obvious difference is that, unlike the Work for 
Hire Document, the StreetFax Contract relates only to Mr. Zuckerberg's work on the StreetFax project 
and does not contain any references to Facebook. 

Thus while Stroz Friedberg did not find any copies of the Work for Hire Document, it did uncover the 
StreetFax Contract relating exclusively to Mr. Zuckerberg's work on the StreetFax project. 

2. A Metadata Analysis Supports the Authenticity of the StreetFax Contract and 
the StreetFax Emails 

Stroz Friedberg conducted an analysis of the metadata associated with the "Sent Items.dbx" file and the 
StreetFax Emails, which provide additional corroboration that the StreetFax Emails and the attached 
StreetFax Contract are authentic. 7 Specifically, Stroz Friedberg found that the metadata indicates that the 
StreetFax Emails were sent on March 3, 2004. The metadata did not contain any anomalies. 

(1 ) Metadata for the Sent Items.dbx File Is Consistent with Authentic Emails 

Stroz Friedberg examined the file system metadata associated with the "Sent Items.dbx" file containing 
the StreetFax Emails. The file system metadata for the "Sent Items.dbx" file indicates that it was created 
on December 23, 2003 and has not been modified or accessed since June 22, 2008. 



6 The StreetFax Contract appears to be oriented upside-down in TIFF images found on the Ceglia Media. In Exhibits 
F and H, we have rotated the pages of the StreetFax Contract so that they are oriented correctly. 

7 Stroz Friedberg conducted the metadata analysis because information about the creation date and use of those files 
could bear on their authenticity. Computer operating systems use file systems to organize and store electronic files 
on digital media, and file systems generally store metadata about the individual files within the file system. This type 
of metadata is referred to as file system metadata. File system metadata typically includes the file's physical location 
on the media, the location of the file within the directory structure of the file system, and timestamps, such as when 
the file was first created on the file system, when the file was last accessed, and when the file was last modified. 
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The last accessed date of the "Sent Items. dbx" file is consistent with legitimate emails. While the last 
accessed file system timestamp can be updated by user or system actions, such as the opening of 
Microsoft Outlook Express or the automatic running of an antivirus scan, the metadata shows that the 
"Sent Items.dbx" file has not been accessed by a user or an automated process since June 22, 2008. 
Since the StreetFax Emails were sent and received on March 3, 2004, Stroz Friedberg would expect the 
last accessed date of the "Sent Items.dbx" file to post-date that date, which is the case here. 

(2) Metadata for the StreetFax Emails Is Consistent with Authentic Emails 

Stroz Friedberg also examined the metadata associated with the StreetFax Emails themselves, including 
the sent date and time for each email. That metadata, which appears below, corroborates the 
authenticity of the StreetFax Emails because it confirms that the emails were sent on March 3, 2004: 



Subject 


Sent Date/Time 


Attachment 


page 1 of 2 for Streetfax contract w mark 


03/03/2004 10:37:15 AM 


Scan0002.tif 


2 of 2 for streetfax contract 


03/03/2004 10:39:11 AM 


Scan0001 .tif 



B. Other Evidence on the Ceglia Media Establishes the Authenticity of the 
StreetFax Contract and the StreetFax Emails 

Stroz Friedberg identified other evidence on the Seagate Hard Drive and the Forensic Image Created by 
Plaintiff's Expert that corroborates that the StreetFax Emails were sent on March 3, 2004. 

1 . The Attached Scans of the StreetFax Contract Were Created on the Ceglia 
Media Minutes Before the StreetFax Emails Were Sent 

Mr. Ceglia sent the email that attached the second page of the StreetFax Contract to Jim Kole at 10:37:15 
a.m. He sent the second email that attached the first page of the Street Fax Contract at 1 0:39:1 1 a.m. 
The two scanned images - i.e., the attached pages of the StreetFax Contract - were created on a 
computer produced by Mr. Ceglia shortly before the two emails were sent. 

Stroz Friedberg found evidence of a deleted file named "Scan0002.tif," which was created on March 3, 
2004 at 10:35:21 a.m. Although the file was deleted, Stroz Friedberg was able to partially recover and 
view its contents using digital forensic techniques. The recoverable portion of this file appeared to match 
the second page of the StreetFax Contract. Stroz Friedberg also compared the file sizes and determined 
that the deleted file was exactly the same size as the copy of "Scan0002.tif" that was emailed to Mr. Kole. 
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Stroz Friedberg also found evidence of a deleted file named "Scan0001 .tif," which was created on March 
3, 2004 at 10:38:35 a.m. The contents of this file could not be recovered. However, Stroz Friedberg 
compared the file sizes and determined that it was exactly the same size as the copy of "Scan0001 .tif" 
that was emailed to Mr. Kole. 

Thus, the digital forensic evidence reflects the following chronology of events. On the morning of March 
3, 2004 at 1 0:35:21 a.m., a scanned copy of the second page of the StreetFax Contract was saved to the 
computer containing the Seagate Hard Drive. Approximately two minutes later, at 1 0:37:1 5 a.m., this file 
was sent as an attachment to the first StreetFax Email that Mr. Ceglia sent to Mr. Kole. Shortly thereafter, 
a scanned copy of the first page of the StreetFax Contract was saved onto the computer containing the 
Seagate Hard Drive at 1 0:38:35 a.m., and emailed to Mr. Kole less than a minute later at 1 0:39:1 1 a.m. 

The contemporaneous creation of files with the same names and sizes as the StreetFax Contract on the 
Seagate Hard Drive corroborates that the pages of the StreetFax Contract were scanned to that hard 
drive on the morning of March 3, 2004 and sent to Mr. Kole using the computer containing the Seagate 
Hard Drive shortly thereafter. 

2. March 4-5, 2004 Emails from Jim Kole Support the Authenticity of the 
StreetFax Emails 

In its review of Mr. Ceglia's Gmail (paulceglia@gmail.com) account, obtained pursuant to Mr. Ceglia's 
consent, Stroz Friedberg identified a June 30, 201 1 email from Jessica Ceglia, Mr. Ceglia's niece, to Mr. 
Ceglia. Attached to this email are photographs of paper documents. One of the photographs is of a 
printout of an email chain sent on March 4-5, 2004, involving Mr. Ceglia, Mr. Kole, and Karin Petersen, a 
former StreetFax employee. The printout appears to have been printed by Mr. Kole, as the top of the 
document, where Microsoft Outlook identifies the name of the user whose account was used to print the 
email, reads "Kole, James D." 
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Kol«, Jamas D. 



Wit I'll Ml 

wJii ft/** 



rrom: 
Sent; 

Tor 

Subject 



paul ceglia [paulceglia@msn.com] 
Friday. March 05. 2004 1 1 44 AM 
jkol8@5idley.com ./ 
RE marks undone work / 



Funds are indeed very tight right now and my concern about sending mark 
money is two fold, firac if I send him cash then I wont have money to give 
to another IT person and second are we jeopardixzing ourselves by offering 
him money on a contract that so clearly staes we owe him nothing? Mabe I an 
a littel to emotionally charged about this but I think that after him 
illegally removing functionality form the site that 1 dont want to pay this 
kid another dime. I am open to reason though. All the best, Paul ?-ffijB 

■>Frotn: "Kole, James D. " <j kole£sidley. com> 
>To: "'paul ceglia'" <paulceglia@msn.com> 

>CC: ■•kpetersenestreetfax.com* " <kpetersenBstreetfax.com> 
>Subject: RE: marks undone work 
>Date: Thu, 4 Mar 2004 I ■. : 1 S : 4 4 -0600 

>Paul, 
> 

>Karin suggested she could use some more time to back-up all files, etc., 
>and 

>I suspect the brat programmer will turn to this over the weekend, so I 
>suggest that I send out the letter Friday afternoon. If you have any cash 
>to spare now, I would be happy to include in the letter a statement that I 
>have a payment for him that 1 will hold in escrow until he provides his 
>written assurance that he will not access or disable any portion of the 
>site. If you have the cash to do that, it makes you appear even more 
reasonable, if we have to start a lawsuit. Obviously, a lawsuit is only a 
>worst worst case plan, but if he carries through on his threats, we may 
>need 

>to get a court order to stop his trespasses. 
>I'll fire away, Jim 

Original Message 

>From: paul ceglia [mailto:paijlceglia@msn.com] 
>Sent: Thursday, March 04, 2004 9:49 AM 
>To: j kolef*sidley . com 
>Subject: RE; marks undone work 



turns , 



Let me know your thoughts and 



>Hi Jim Looks great, 
you 



Much less threatening than I could have mustered. 



think at this point it i still wise to pay him the money he requests or are 
you just breaking up the battle into skirmishes? Ill be on my tmail account 
the rest of the day heading up to the cemetery, pceglia8tmail.com 
thanks for jumping on this. 

I would say to your wonderful holdiay card that it has also been a great 
pleasure geeting to know you as well. It sounds like you are really 
enjoying being back in Chicago. I hope we manage to cover it this summer. 
All the best, Paul 



>From: "Kole, James D." <jkole@sidley. com> ,„ 
>To: "Karin Petersen'" <kpetersen9streetfax. com>, "'paulceglia8msn.com 
xpaulcegl ia0msn . com> 



Fig. 4: Photograph of Printed March 4-5, 2004 Email Chain 



Mr. Kole's printout of the email chain contains a handwritten note in the upper-right margin. The 
handwritten note reads as follows: "I think I'll just make a veiled reference to payments that could be 
made if he settles the matter as a businessman rather than a cyber-briber. PLEASE, PLEASE fax me the 
contract as I can't read the one sent earlier to understand his or your breach [crossed-out text] 
argume[cutoff text]." 

This document is significant because it is evidence that Mr. Kole earlier had received a copy of the 
contract between Mr. Ceglia and Mr. Zuckerberg that was difficult to read. As noted above, the copy of 
the StreetFax Contract attached to the March 3, 2004 emails to Mr. Kole is a low-quality scanned image. 
Thus, the handwritten note on the printout of the March 4-5, 2004 email chain corroborates the 
authenticity of the StreetFax Emails. 
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VIII. The StreetFax Contract (Sidley Austin) 

A. Sidley Austin Produced Copies of the StreetFax Emails and the 
Attached StreetFax Contract 

Stroz Friedberg also was provided copies of the StreetFax Emails from Sidley Austin, the law firm for 
which Stroz Friedberg understands Mr. Kole worked when Mr. Ceglia sent him the StreetFax Emails. The 
StreetFax Emails were sent to Sidley Austin's domain, sidley.com. Stroz Friedberg further understands 
that these copies of the StreetFax Emails were produced by Sidley Austin pursuant to a subpoena 
authorized by the Court. 



B. The StreetFax Emails Are Identical to the Ceglia Copies 

Stroz Friedberg conducted a visual comparison of the copies of the StreetFax Emails on the Ceglia Media 
and the StreetFax Emails produced by Sidley Austin. Stroz Friedberg determined that the two copies 
appeared to be identical. 

Stroz Friedberg then conducted an analysis of the sender, recipient, sent on, and subject metadata, as 
well as the content and attachments, of the two sets of StreetFax Emails. Stroz Friedberg determined 
that the metadata, the content, and the attachments of the two sets of StreetFax Emails matched. This 
was expected, given that the copies constitute two halves of an email correspondence - the sender's side 
and the recipient's side. 

In addition, Stroz Friedberg conducted an automated comparison of the attached pages of the StreetFax 
Contract produced by Sidley Austin and the attached pages of the StreetFax Contract found on the Ceglia 
Media. This comparison was done by generating hash values for the TIFF image files. A hash value is a 
digital fingerprint of a file generated by running the contents of a file or other electronic data set through a 
cryptographic algorithm to produce a string of alphanumeric characters. If two electronic files differ even 
by a single bit, they would have different hash values. 

Stroz Friedberg confirmed that the attached pages of the StreetFax Contract produced by Sidley Austin 
and the attached pages of the StreetFax Contract found on the Ceglia Media have matching hash values 
and that they are identical. Again, this was expected, since these come from the two sides of the same 
email correspondence. 
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C. The Internet Headers of the StreetFax Emails Confirm That They Were 
Routed Through Sidley Austin's and Adelphia's Servers on March 3, 
2004 

The Internet headers of the StreetFax Emails confirm that those emails were sent and received on March 
3, 2004 through servers used by Adelphia and Sidley Austin. 

When an email message is transmitted across the Internet from the sender to a recipient, each server 
that is used in the transmission affixes to the header information of the email the date and time when the 
email message was received by the server. This information can be used to reconstruct an email 
message's path through the Internet, as it shows both what servers were used to transmit the email along 
its path from sender to recipient and the date and time of the transmission. 

The Internet header related to the email's transmission is affixed to the email message by the servers 
through which the email passes, not the computer used to send or receive the email. This means that the 
Internet header information related to the transmission of the StreetFax Emails was affixed by servers 
controlled by Adelphia and Sidley Austin and is not dependent on the date and time settings of the 
computers used by Mr. Ceglia or Mr. Kole. The Internet header thus provides additional information to 
establish the authenticity of the StreetFax Emails. 

1 . The Internet Header of the StreetFax Email Sent At 1 0:37 a.m. 

The earlier of the two StreetFax Emails was sent at 1 0:37 a.m. Eastern Standard Time and had the 
subject "page 1 of 2 for Streetfax contract w mark." The Internet header of that email confirms the 
following: 

> The email was sent from a computer with the IP address 24.53.222.222 to a server at 
adelphia.net and received by that server at 10:37:10 a.m. Eastern Standard Time on March 3, 
2004. Records obtained from Adelphia demonstrate that the adelphia.net account used to send 
the StreetFax Emails was registered to Carmine Ceglia. In his October 24, 201 1 declaration, Mr. 
Ceglia identified this account as belonging to his parents (Ceglia October 24, 201 1 Declaration, 
Doc. No. 180, at f 8(b)). 

> The email then was sent from the Adelphia server to a server at sidley.com and received by that 
sidley.com server at 9:38:01 a.m. Central Standard Time on March 3, 2004. The sidley.com 
server is used by Sidley Austin, the law firm where Stroz Friedberg has been informed that Mr. 
Kole worked and had an email address at the time. 
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> The email then was routed internally from one Sidley Austin server (mail02) to another 

(chexchange04) and received by the Sidley Austin server chexchange04 at 9:38:08 a.m. Central 
Standard Time on March 3, 2004. 8 

The Internet header related to the transmission of the 10:37 a.m. StreetFax Email produced by Sidley 
Austin appears below: 



Received: from mail02.sidley.com (MAIL02 [10.16.4.97]) by chexchange04.sidley.com with SMTP 
(Microsoft Exchange Internet Mail Service Version 5.5.2654.52) 

id FNLSNFD1 ; Wed, 3 Mar 2004 09:38:08 -0600 
Received: from 68.168.78.199 by mail02.sidley.com with SMTP (Tumbleweed 
MMS SMTP Relay); Wed, 03 Mar 2004 09:38:01 -0500 
Received: from youro0kwkw9jwc ([24.53.222.222]) by mta9.adelphia.net ( 
InterMail vM.5. 01 .06.05 201-253-122-130-105-20030824) with SMTP id 
<200403031 5371 0.ELGV26462.mta9.adelphia.net@youro0kwkw9jwc> for 
<jkole@sidley.com>; Wed, 3 Mar 2004 1 0:37:1 -0500 



Fig. 5: Internet Header of 10:37 a.m. StreetFax Email Produced by Sidley Austin 9 

The second of the two StreetFax Emails was sent at 1 0:39 a.m. Eastern Standard Time and had the 
Subject "2 of 2 for streetfax contract." The Internet header of that email confirms the following: 

> The email was sent from a computer with the IP address 24.53.222.222 to a server at 
adelphia.net and received by that server at 10:39:06 a.m. Eastern Standard Time on March 3, 
2004. 

> The email then was sent from the Adelphia server to a server at sidley.com and received by that 
sidley.com server at 9:41 :30 a.m. Central Standard Time on March 3, 2004. 



Due to the time it takes for an email to traverse the Internet from one server to another, it is common for there to be 
small differences between the time an email is sent by one server and the time it is received by another. 

9 The Sidley Austin server named mail02.sidley appears to be set to the Central time zone, as the time it appended to 
this Internet header (9:38:01 a.m.) is approximately one hour earlier than the time appended by the Adelphia server 
(10:37:10 p.m.), which resided in the Eastern time zone. However, the offset indicates that the time zone is set to 
Eastern time. The server time and time zone are separate fields that can be set independently. Thus, the likely 
explanation is that while the server time was correctly set and reflects the actual time in the Central time zone, the 
time zone setting was incorrectly set to Eastern time. 
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> The email then was routed internally from one Sidley Austin server (mail01 ) to another 

(chexchange03) and received by the Sidley Austin server chexchange03 at 9:43:01 a.m. Central 
Standard Time on March 3, 2004. 

The Internet header related to the transmission of the 10:39 a.m. StreetFax Email produced by Sidley 
Austin appears below: 



Received: from mail01 .sidley.com ([1 0.1 6.4.89]) by chexchange03.sidley.com with SMTP 
(Microsoft Exchange Internet Mail Service Version 5.5.2653.13) 

id FNL7R89V; Wed, 3 Mar 2004 09:43:01 -0600 
Received: from 68.168.78.199 by mail01.sidley.com with SMTP (Tumbleweed 
MMS SMTP Relay); Wed, 03 Mar 2004 09:41 :30 -0500 
Received: from youro0kwkw9jwc ([24.53.222.222]) by mta9.adelphia.net ( 
InterMail vM.5. 01 .06.05 201-253-122-130-105-20030824) with SMTP id 
<200403031 53906. EMRF26462.mta9.adelphia.net@youro0kwkw9jwc> for 
<jkole@sidley.com>; Wed, 3 Mar 2004 1 0:39:06 -0500 



Fig. 6: Internet Header of 10:39 a.m. StreetFax Email Produced by Sidley Austin 10 

The Internet header information for the StreetFax Emails establishes that the email messages from Mr. 
Ceglia to Mr. Kole were sent and received on the morning of March 3, 2004, which is the same as the 
sent and received date shown on the faces of the StreetFax Emails. In addition, this evidence confirms 
that the servers used in the transmission were associated with Adelphia, the service provider for the email 
account used by the sender, and Sidley Austin, the employer of the recipient, of the StreetFax Emails. 

In addition to containing the dates and times at which the emails were transmitted from Adelphia's servers 
to Sidley Austin's servers, the Internet headers of the emails also contain detailed information about the 
servers used in the transmission of the messages, including the name and version of the software used 
by the servers. For example, the Internet headers above show that the Sidley Austin servers 
chexchange04.sidley.com and chexchange03.sidley.com are running Microsoft Exchange Internet Mail 
Service ("Microsoft Exchange"), versions 5.5.2654.52 and 5.5.2653.13 respectively. Microsoft Exchange 
version 5.5 was released in November 1997, and version 5.5.2653 was released in November 2000. 
Furthermore, the message IDs for the StreetFax Emails, which are 

<200403031 5371 0.ELGV26462.mta9.adelphia.net@youro0kwkw9jwc> for the 1 0:37 a.m. email and 
<200403031 53906. EMRF26462.mta9.adelphia.net@youro0kwkw9jwc> for the 10:39 a.m. email, are 



The server mail01 .sidley also appears to have an incorrect time zone setting. 
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distinct and appear to contain timestamps that are consistent with the times that the emails were sent. 11 
These details are important corroborating evidence of the authenticity of the emails, as the names and 
versions of the software being run are consistent with the software and versions that could have been 
running on Sidley Austin's servers in March 2004. 



D. The Metadata of the PST File in Which the StreetFax Emails Were 
Located Supports the Authenticity of the Emails 

Sidley Austin produced the StreetFax Emails within a PST file, which is a Microsoft Outlook container file 
used to store multiple Microsoft Outlook items such as messages, calendar items, and contacts. A PST 
file contains metadata about the messages stored within it, as well as the metadata contained within the 
messages themselves. 

Specifically, the PST file shows that the StreetFax Emails were forwarded on March 3, 2004 between 
10:47 a.m. and 10:48 a.m. Eastern Standard Time, approximately 10 minutes after Mr. Kole received 
these emails. No information was provided regarding the indentity of the person or persons to whom Mr. 
Kole forwarded those emails. This means that Mr. Kole had to have received the StreetFax Emails prior 
to March 3, 2004 at 10:47 a.m. Eastern Standard Time, as he could not have forwarded them prior to 
receiving them. 

In addition, the file system metadata of the PST shows that it was created on January 27, 2006 and last 
modified on February 20, 2007. 12 As such, the StreetFax Emails existed in the PST no later than 
February 20, 2007. Since the StreetFax Emails were sent and received on March 3, 2004, Stroz 
Friedberg would expect the last modified date of the PST file at Sidley Austin file to post-date that date, 
which is the case here. 



11 The timestamps in the message IDs appear to be listed in Coordinated Universal Time, which is five hours ahead 
of Eastern Standard Time. For example, 10:37 a.m. Eastern Standard Time would correspond with 3:37 p.m. 
Coordinated Universal Time. 

12 PST files can be created by users to manage email in a variety of ways, including (1 ) to store related emails (e.g., 
all emails related to StreetFax); or (2) to reduce the size of an online mailbox in response to size limitations or for 
other reasons. Thus, it is common to see a PST file whose creation date post-dates the sent or received date of 
some or all of the emails it contains. 
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IX. The Purported Emails (Ceglia Media) 

Mr. Ceglia's Amended Complaint purports to quote from or otherwise reference 22 Purported Emails 
between Mr. Ceglia and Mr. Zuckerberg. During the litigation, Mr. Ceglia acknowledged that he did not 
keep the Purported Emails referenced in the Amended Complaint in their original native form, that is to 
say, as individual files in message format. Rather, he claimed to have copied-and-pasted the text of the 
Purported Emails into Microsoft Word documents saved to floppy disks in order to maintain copies of 
these messages, as he claimed he did not know of any other way to preserve emails. (Ceglia June 12, 
201 1 Declaration, Doc. No. 65, at H 11). Mr. Ceglia also claimed to have performed this copy-and-paste 
process in 2003 and 2004, "[d]uring and just after [he] discontinued regular email communication with Mr. 
Zuckerberg." (Ceglia November 17, 2011 Declaration, Doc. No. 225, at Hf 5, 7). 

During its analysis of the Ceglia Media, Stroz Friedberg searched for the Purported Emails quoted or 
otherwise referenced in the Amended Complaint and identified the emails as existing only in three Word 
documents, which are attached to this report as Exhibits I, J, and K. The Purported Emails in these Word 
documents had content that resembled the text quoted in the Amended Complaint. Stroz Friedberg did 
not identify any copies of the Purported Emails in email format files. 

Specifically, Stroz Friedberg identified three files containing the text of 27 purported emails: (1) "Mark 
emailsjuly04.doc," containing three purported emails between Mr. Zuckerberg and Mr. Ceglia, dated 
between April 6, 2004 and July 22, 2004; (2) "Mark harvard emails up to Dec.doc," containing nine 
purported emails between Mr. Zuckerberg and Mr. Ceglia, dated between July 30, 2003 and November 
30, 2003; and (3) "markfeb emails.doc," containing fifteen purported emails between Mr. Zuckerberg and 
Mr. Ceglia, dated between January 1 , 2004 and February 7, 2004. These three files were produced on 
two media: (1 ) a floppy disk produced in Chicago, Illinois; and (2) a CD produced in Sarasota, Florida. 13 

Mr. Ceglia claims to have copied-and-pasted the text of the 27 purported emails to Word documents that 
were then saved to a floppy disk in 2003 and 2004, when the purported emails supposedly were sent and 
received. Specifically, in Mr. Ceglia's November 17, 2011 declaration, he stated that he "saved those 
files to floppy disks." (Ceglia November 1 7, 201 1 Declaration, Doc. No. 225, at f 8). This floppy disk 
appears to be one of the floppy disks copied by John Evans, 14 one of Mr. Ceglia's retained experts, and 
subsequently analyzed by another of Mr. Ceglia's forensic experts, Jerry Grant. In his November 1 6, 



13 The files are not exact duplicates and do not have the same hash values on each media. However, it appears from 
a manual inspection that the content of each document on each media is the same. 

14 In his June 17, 201 1 declaration, Mr. Evans stated, "[o]ne of the floppy disks in PLA's custody, as collected and 
imaged from Mr. Ceglia, contains three Microsoft Word documents containing what I understand to be email 
communications between Mr. Ceglia and Mr. Zuckerberg relating to the issues in this case." (Evans June 17, 201 1 
Declaration, Doc. No. 61 , at % 8). 
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201 1 declaration, Mr. Grant states that he "received 41 floppy disks for review" and "determined that the 
first 2 were relevant to this matter." (Grant November 16, 201 1 Declaration, Doc. No. 226, at 9, 10). 

Stroz Friedberg found substantial evidence that all three of the Word documents containing the purported 
emails are backdated. The effect of backdating is to obscure the true date and time at which computer 
activity, such as the creation or modification of documents, occurred. Backdating can be accomplished 
by setting the system clock on a computer hard drive to an earlier date, such that activity that occurs on 
the hard drive while the computer is in a backdated state will appear to have occurred at that earlier time. 

In addition, the text of the Purported Emails themselves demonstrates that they are fabricated. 

A. All Three Word Documents Containing the Text of the Purported Emails 
Are Backdated 

Mr. Ceglia produced three unique Microsoft Word documents - "Mark emails july04.doc," "Mark harvard 
emails up to Dec.doc," and "mark feb emails.doc" - containing the text of 27 purported emails, all of which 
were backdated. 

1 . The Word Document "Mark emails july04.doc"Has Been Backdated 

As noted above, the Word document "Mark emails july04.doc" contains the text of three purported emails 
that supposedly were sent and received between April 6, 2004 and July 22, 2004. However, Stroz 
Friedberg found substantial evidence that there were multiple versions of this file, some of which were 
backdated. 

Stroz Friedberg found five entries related to this file on a floppy disk produced in Chicago, Illinois, one of 
which relates to an active file and the remaining four of which relate to deleted versions of the file. The 
active file purports to have been created, last modified, and last accessed 15 on July 23, 2004. However, 
two of the records related to deleted copies have file created timestamps from an earlier date, October 
21 , 2003, as follows: 



File Name 


State 


File Created 


Last Written 


Last Accessed 


Mark emails july04.doc 


Active 


07/23/2004 09:46:51 AM 


07/23/2004 06:24:28 PM 


7/23/2004 


Mark emails july04.doc 


Deleted 


10/21/2003 11:52:59 AM 


10/21/2003 11:53:00 AM 


10/21/2003 


Mark emails july04.doc 


Deleted 


10/21/2003 11:53:49 AM 


07/23/2004 10:18:50 AM 


10/21/2003 



15 No time values are available for this metadata field as the FAT file system on the floppy disk does not maintain that 
information. 
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This metadata anomaly constitutes evidence of backdating because a file that was last modified in 
October 2003 could not contain authentic emails from July 2004. It also is highly unlikely that this file 
would be named "Mark emailsjuly04.doc" if it actually had been created and last modified in October 
2003. This metadata anomaly likely resulted from at least one copy of the file named "Mark emails 
july04.doc" having been saved using a computer with a system clock backdated to October 21 , 2003. 

Moreover, the existence of multiple copies of this and other files is significant in and of itself. It is Stroz 
Friedberg's experience that in the process of creating a forged electronic document, the forger frequently 
creates and deletes multiple versions of the document being forged. These versions often evidence 
metadata anomalies and reflect iterative attempts to backdate or forge the documents. 

2. The Word Document "Mark harvard emails up to Dec. doc" Has Been 
Backdated 

The Word document "Mark harvard emails up to Dec.doc" contains the text of nine purported emails that 
supposedly were sent and received between July 30, 2003 and November 30, 2003. This document 
contains the same metadata anomaly as the file named "Mark emails july04.doc." 

Stroz Friedberg found seven entries related to this file on a floppy disk produced in Chicago, Illinois. One 
of the seven entries relates to an active file and the remaining six relate to deleted versions of the file. 
The active file purports to have been created, last modified, and last accessed on July 23, 2004. 
However, two of the records related to deleted copies indicate that the file was created, last modified, and 
last accessed on the earlier date of October 21 , 2003, as follows: 



File Name 


State 


File Created 


Last Written 


Last Accessed 


Mark harvard emails up to Dec.doc 


Active 


07/23/2004 09:47:01 AM 


07/23/2004 06:15:54 PM 


7/23/2004 


Mark harvard emails up to Dec.doc 


Deleted 


10/21/2003 11:54:12 AM 


10/21/2003 11:54:14 AM 


10/21/2003 


Mark harvard emails up to Dec.doc 


Deleted 


10/21/2003 11:54:49 AM 


10/21/2003 11:54:50 AM 


10/21/2003 



Again, a document that was last modified in October 2003 could not contain authentic emails from 
December 2003. It also is highly unlikely that this file would be named "Mark harvard emails up to 
Dec.doc" if it actually had been created and last modified in October 2003. This discrepancy likely 
resulted from the files having been saved with a computer whose system clock had been backdated to 
October 21 , 2003, which is the same date as the deleted version of "Mark emails july04.doc" was saved. 
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3. The Word Document "mark feb emails.doc" Has Been Backdated 

The Word document "mark feb emails.doc" contains the text of fifteen purported emails that supposedly 
were sent and received between January 1 , 2004 and February 7, 2004. Mr. Ceglia produced this Word 
document on a floppy disk in Chicago, Illinois. The file "mark feb emails.doc" has a purported creation 
date of July 23, 2004. However, when Stroz Friedberg reviewed records of deleted files on the floppy 
disk, it discovered a metadata anomaly. 

Specifically, the floppy disk contains a record of a deleted version of the file "mark emails 082903.doc." 
That deleted file has a last accessed date of February 1 8, 201 1 , which indicates that the file was deleted 
on or after that date. The metadata of the files on the floppy disk shows that no files were added to or 
modified on the floppy disk since July 23, 2004. This fact, and the fact that a copy of "mark emails 
082903.doc" was deleted on or after February 1 8, 201 1 , are not consistent with the amount of disk space 
available on the floppy disk. 

The deleted version of "mark emails 082903.doc" was 17,128 bytes in size. Therefore, there should be at 
least 17,128 bytes of free space available on the floppy disk, since no files have been added to the disk 
or modified after February 1 8, 201 1 , the date the file was deleted. In fact, according to the metadata, no 
files have been added to, or modified on, the floppy disk since July 23, 2004. However, the floppy disk is 
almost full and only has 2,048 bytes of free space available. Thus, the actual amount of available disk 
space reflects usage that is inconsistent with the dates and times in its metadata. This anomaly 
demonstrates that data was added to the floppy disk on or after February 1 8, 201 1 and that the dates and 
times of files on this floppy disk are not accurate and have been backdated. 

Moreover, the deleted file "mark emails 082903.doc" sat in the same location on the floppy disk where the 
active file "mark feb emails.doc" now sits. Since data can only be written to available disk space, the file 
"mark feb emails.doc" could not have been saved to the floppy disk until the file that previously resided in 
the location where it was saved - "mark emails 082903.doc" - had been deleted. The file "mark emails 
082903.doc" was not deleted until on or after February 1 8, 201 1 , meaning that the file "mark feb 
emails.doc" was added to the floppy disk after that date. Consequently, the purported July 23, 2004 
creation date for that file is incorrect and provides further evidence of backdating. 

Thus, the file "mark feb emails.doc" likely was created on the floppy disk sometime on or after February 
1 8, 201 1 , using a computer whose system clock was backdated to July 23, 2004. 
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B. The Purported Emails Contain the Wrong Time Zone Stamps 

In addition to the backdated Microsoft Word documents containing the Purported Emails, the text of the 
Purported Emails themselves constitutes substantial evidence that they are fabricated. 

Each of the purported emails contains a "Date" line that contains the date and time the email was 
purportedly sent, a line that is normally automatically added to an email by the computer's system clock. 
At the end of each "Date" line, the time zone that the email was purportedly sent in is indicated with an 
offset of the format "+HHMM" or "-HHMM." HHMM indicates hours and minutes from Coordinated 
Universal Time ("UTC"); the + or - indicates whether the time zone is before or after Coordinated 
Universal Time. For example, Eastern Daylight Time is represented as "-0400" and Eastern Standard 
Time is represented as "-0500." 

Standard time was in effect in the United States from late October 2003 to early April 2004. Thus, one 
would expect that authentic emails sent during that time period from a location in the Eastern Time Zone 
would contain the "-0500" stamp, in the absence of an inaccurate system clock. However, all but one of 
the 27 purported emails contain the "-0400" time zone stamp for Eastern Daylight Time, including all of 
the purported emails supposedly sent between October 26, 2003 and April 4, 2004. There is no place in 
the Continental United States from which an email could have been sent with the "-0400" time zone 
stamp during this time period using a computer with an accurate and properly set system clock. 

Below is an example of a purported email chain between Mr. Zuckerberg and Mr. Ceglia. This email 
chain purportedly occurred on February 4, 2004, when standard time and not daylight saving time was in 
effect. If these emails were authentic and, in fact, had been sent on February 4, 2004 during standard 
time, they would have the "-0500" time zone stamp reflecting Eastern Standard Time. However, these 
purported emails display the "-0400" time zone stamp reflecting Eastern Daylight Time, which, again, was 
not in effect on February 4, 2004. 



27STROZ FRIEDBERG 



Case 1:1 0-cv-00569-RJA -LGF Document 325 Filed 03/26/1 2 Page 32 of 102 



From: paul cealia < paulcealiara).msn.com > 

To: Mark Elliot Zuckerbem < mzuckerb@.Tas. harvarci.edu > 

Subject: Re: The site is online! 

Date: Wed, 4 Feb 2004 10:30:16-0400 

QojjgjaJ^Mark! The site looks great. Just wondering if we might think of anothertitle for it without 
thetJ/jg, but plenty of time for that, I'll try and think of some names, i looked forweeksto finally 
find streetfax.com and that is how i named it. backwards from the availability, I'm sure you 
checked to see if just facebook.com was available? you know anotherthing jjy^been thinking of 
that! perfected inStj^eJJa^cJs going city to city. If you went city to gjyjjwith this I think it would be 
fareasierthan just trying to open it up to all ivy league schools at once, actually get on the ground 



in each place, we send a half dozen guys into the city on bikes and within a. few weeks we have 
photos of every intersection in the place, so the same thing could be done arjMl putting up flyers 
to promote the site, just brainstorming some ideas on howwe can start making some money. 



>From: Mark Elliot Zu.ckerp.ejrg < mzuckerb@fas harvard.edu > 

>To: gjjy cjejalja, < paulcealia@msn.com > 

>Subject: The site is online! 

>Date: Wed, 4 Feb 2004 08:27:39 -0400 

> 
> 

>Paul. 

> lhefacebook.com" opened for students today, when you get a chance take a look at it. I'll let 
you know how it >goes. 

> 



Fig. 7: Screenshot of Purported Emails with -0400 Time Zone Stamp 



Put simply, Mr. Ceglia's purported emails dated between October 26, 2003 and April 4, 2004 display the 
time zone stamp reflecting Eastern Daylight Time. This would not be possible if the purported emails 
were authentic, as Eastern Standard Time was in effect at that time. 
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C. The Purported Emails Are Inconsistently Formatted 

The header information in the purported emails also is inconsistently formatted, which is significant 
because this information is automatically generated when an email is created, not typed by the user. As 
such, if the purported emails were authentic, the formatting of the headers should be consistent, since the 
purported emails were allegedly copied-and-pasted from the same source. The inconsistent formatting 
indicates that the purported emails were not copied-and-pasted from Mr. Ceglia's webmail, as he has 
asserted. (Ceglia November 1 7, 201 1 Declaration, Doc. No. 225, at 1 7). 

For example, the majority of the purported emails in the Word document "mark feb emails.doc" indicate 
the sender in the header information with a line starting "From: ", with a single space following the colon. 
This can be seen in the screenshot below, which is a copy of the header information from one of the 
Purported Emails with the formatting marks revealed: 

From: Mark- Elliot- Zuckerberg-< mzuckerb(S>fas.harvard.edu- >■ 

To: -paul- ceglia- < paulceglia@msn.com > 

Subject: The- site. 

Date: ■ Fri, -6- Feb- 2004- 22: 1 2:51 ■ -0400- H 

Fig. 8: Screenshot of Purported Email with One Space After "From:" 

However, three emails in that same Word document indicate their sender with a line starting "From: ", 
with two spaces after the colon. An example of this can be seen in the screenshot below, which is a copy 
of the email header information from another one of the Purported Emails with the formatting marks 
revealed: 

From:-paulceglia- < paulceglia@msn.com > 

To: ■ Mark- Elliot- Zuckerberg-< mzuckerb(5}fas. harvard.edu- >■ 

Subject: Re: The site is online! 

Date: - Wed, -4- Feb- 2004- 1 0:30: 1 6- -0400U 

Fig. 9: Screenshot of Purported Email with Two Spaces After "From:" 

A similar inconsistency appears in the purported emails in regard to the number of spaces after the colon 
in the "To" field. Various purported emails show one, two, or three spaces after the colon in the "To" field. 
For instance, in the two screenshots shown above in Figures 8 and 9, there is one space following the 
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colon in the "To" field. However, in the two purported emails shown below, shown with their header 
information and formatting remarks revealed, there are two or three spaces following the colon in the "To" 
field: 

From: -Mark- Elliot- Zuckerberg-< mzuckerb@fas. harvard.edu- >■ 

To:--paulceglia- < paulceglia@msn.com > 

Subject: -Re: the-database 

Date:Fri,-16Jan-2004-23:46:53-0400-H 

Fig. 10: Screenshot of Purported Email with Two Spaces After "To:" 

>From: paul ceglia- <paulceglia@msn.com> 

>To:- ■ ■ Mark- Elliot- Zuckerberg ■ < mzuckerb(a)fas. harvard.edu- > ■ 

> Subject: -the- database- * 

>Date: Tues,-13 Jan-2004 08:07:28 -0400 - - 

Fig. 1 1 : Screenshot of Purported Email with Three Spaces After "To:" 

If the purported emails were actually copied-and-pasted from one authentic source, such as Mr. Ceglia's 
MSN account, these inconsistencies in spacing in the "From" and "To" fields would not exist. 

Similarly, the word "Tuesday" is inconsistently abbreviated in the automatically-generated headers of the 
purported emails. In some of the purported emails, the word is abbreviated "Tue". This can be seen in 
the screenshot below, which is a copy of the header information from one of the Purported Emails with 
the formatting marks revealed: 

From:--paulceglia- < paulceglia@msn.com > 

To: ■ Mark- Elliot- Zuckerberg- < mzuckerb@fas.harvard.edu- >■ 

Subject: Re: 

Date: ■ Tue, ■ 6- April- 2004- 18:13:41- -0400- - fl 

Fig. 12: Screenshot of Purported Email with the Abbreviation "Tue" 
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However, in other purported emails, the word Tuesday is abbreviated "Tues". This can be seen in the 
screenshot below, which is a copy of the header information from another one of the Purported Emails 
with the formatting marks revealed: 

From: -paul- ceglia- < paulceglia(j5}msn.com > 

To: ■ Mark- Elliot- Zuckerberg-< mzuckerb(jS)fas. harvard.edu- >■ 

Subject: Re: ■ Going- live 

Date:Tues,-3Feb-2004-07:56:01-0400U 

Fig. 13: Screenshot of Purported Email with the Abbreviation "Tues" 

This internal inconsistency between "Tue" and "Tues" should not exist if the purported emails actually 
were copied-and-pasted from one authentic source. 

Moreover, the "Tues" abbreviation for Tuesday, which appears in the email excerpted in figure 13 above, 
is inconsistent with the way that MSN actually abbreviates Tuesday. MSN abbreviates "Tuesday" as 
"Tue". Therefore, the abbreviation "Tues" should not appear in any emails copied-and-pasted from MSN. 

In addition, these screenshots show one other significant and revealing formatting discrepancy. Figure 9 
has a paragraph symbol immediately following the time zone indicator (-0400), which would be expected 
if the purported emails were actually copied-and-pasted from one authentic source. However, Figure 13 
shows one space before the paragraph symbol, while Figures 8, 10, and 12 show two spaces before the 
paragraph symbol. Moreover, Figure 1 1 has a long series of spaces to the end of the line. These 
additional spaces before the paragraph symbol are anomalous; moreover, the number of spaces should 
be consistent among authentic emails copied-and-pasted from one authentic source. This discrepancy is 
further evidence that these purported emails were either manually typed or edited and were not solely the 
result of a copy-and-paste operation. 

Finally, all four screenshots have an extra space between the end of Mr. Zuckerberg's email address 
(mzuckerb@fas.harvard.edu) and the closing angle bracket (">"). If these purported emails actually were 
copied-and-pasted, there should not be such a space. Thus, the extra space is additional evidence that 
the purported emails were not the result of a copy-and-paste operation. 
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X. The Purported Emails (Webmail Accounts) 

Pursuant to the Court's Orders, subpoenas, and/or Mr. Ceglia's consent, Stroz Friedberg acquired the 
following webmail accounts for Mr. Ceglia: 

(1) paulceglia@msn.com; and 

(2) paulceglia@gmail.com. 

In addition, the contents of the following webmail accounts were produced to Stroz Friedberg pursuant to 
Court Orders, subpoenas, and/or Mr. Ceglia's consent: 

(1) paulceglia@msn.com; 

(2) paulceglia@gmail.com; 

(3) getzuck@gmail.com; 

(4) alleganypellets@gmail.com; and 

(5) landlubber39@yahoo.com. 

Stroz Friedberg searched these webmail accounts for copies of the purported emails quoted or otherwise 
referenced in the Amended Complaint. Stroz Friedberg did not identify any of these messages in native 
format. 

Mr. Ceglia has also been ordered to consent to the acquisition and inspection of the webmail account, 
paulc@hush.com, the contents of which Stroz Friedberg expects to receive. 
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XI. Seven Backdated Versions of the Work for Hire Document 

During its analysis of the Ceglia Media, Stroz Friedberg searched for, and did not identify, any exact 
electronic copies of the Work for Hire Document attached to the Amended Complaint. The absence of an 
electronic copy is notable because, as described above, Mr. Ceglia claimed in Court to have printed the 
contract. In addition, Mr. Ceglia emailed the Work for Hire Document on two occasions in the days before 
filing this lawsuit: once on June 27, 201 to Paul Argentieri, and once on June 29, 201 using his Gmail 
(paulceglia@gmail.com) account to Karin Peterson. Thus, the Work for Hire Document existed in 
electronic form at some point close in time to the filing of this litigation, and Stroz Friedberg would have 
expected to find it on one of the electronic assets that Mr. Ceglia was ordered to produce for inspection. 

Instead of the Work for Hire Document attached to the Amended Complaint, Stroz Friedberg found on the 
Ceglia Media seven unsigned versions of the Work for Hire Document that are very similar but not 
identical to the Work for Hire Document. All seven of those electronic documents contain metadata 
anomalies indicative of backdating and document manipulation. 



A. All Seven Versions of the Work For Hire Document Are Backdated 

All seven versions of the Work for Hire Document found on the Ceglia Media show metadata anomalies 
indicative of backdating, which is an act of manipulating the system clock to make documents appear to 
have been created at an earlier time. 

1 . The File Named "SFWebWorkForHireMZ.doc" Has Been Backdated 

Both the file system metadata of a file named "SFWebWorkForHireMZ.doc," and its location on the floppy 
disk on which it was produced by Mr. Ceglia, show evidence of backdating. 

As noted previously, the file system metadata indicates, among other things, the dates on which a file 
was last written to and last accessed. The last written timestamp shows the last time that a user 
modified, or made a change to, the document. The last accessed timestamp reflects the last time the file 
was opened, whether any changes were made to the document or not. 

It is possible to open a file and update the last accessed date without updating the last written date. 
However, because a user must open a document to modify it, it is not possible to make changes to a 
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document and update the last written timestamp, without also updating the last accessed timestamp. For 
this reason, a file's last written timestamp should not post-date its last accessed timestamp. 16 

The document "SFWebWorkForHireMZ.doc" has the following metadata: 



I File Name 


File Created 


Last Written 


Last Accessed 


SFWebWorkForHireMZ.doc 


05/02/2003 1 1 :24:26 AM 


04/24/2003 03:06:22 PM 


4/22/2003 



The fact that the document's last written date (April 24, 2003) is later than its last accessed date (April 22, 
2003) indicates that backdating has occurred. Specifically, the document named 

"SFWebWorkForHireMZ.doc" was last accessed on a computer whose system clock had been backdated 
to April 22, 2003, the date reflected in the last accessed timestamp. 

This evidence of system clock manipulation is not the only evidence of backdating related to the 
document "SFWebWorkForHireMZ.doc." The location of that file also is significant: 
"SFWebWorkForHireMZ.doc" is an active file that sits on top of and overwrote two deleted files on a 
floppy disk. This means that the two deleted files are no longer present on the floppy disk because a new 
file - "SFWebWorkForHireMZ.doc" - was created on the floppy disk in the same disk space, or physical 
location, previously occupied by the two deleted files. 

When a file is written to a floppy disk, it cannot be written to disk space that currently is occupied by an 
active file. Instead, the file can only be written to available disk space. Disk space is considered available 
if it is empty or if the file currently residing in that space has been deleted. If an active file sits on top of 
and has overwritten a deleted file, the deleted file had to have been deleted before the active file was 
created on or copied to that disk space. As such, the two overwritten files had to have been deleted prior 
to the time that the "SFWebWorkForHireMZ.doc" document was created on the floppy disk. 

The metadata associated with the "SFWebWorkForHireMZ.doc" and the two deleted files it overwrote is 
as follows: 



File Name 


State 


File Created 


Last Written 


Last Accessed 


SFWebWorkForHireMZ.doc 


Active 


05/02/2003 1 1 :24:26 AM 


04/24/2003 03:06:22 PM 


4/22/2003 


Work for Hire ContractMZ.doc 


Deleted 


04/25/2003 04:15:35 PM 


04/25/2003 07:38:06 PM 


2/18/2011 


Work for hire SF template.doc 


Deleted 


04/25/2003 11:49:06 AM 


04/25/2003 01:38:10 PM 


2/18/2011 



16 It is possible for systems to be configured so that updates to last accessed timestamps are disabled. However, the 
close proximity between the last written and last accessed dates of files on floppy disks produced by Mr. Ceglia 
indicates that this condition does not apply for the documents discussed here. 
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When a file is deleted, the last accessed date timestamp is generally updated to the time of the deletion. 
This means that the "Work for Hire ContractMZ.doc" and "Work for hire SF template.doc" files were 
deleted on or after February 1 8, 201 1 . However, based on its creation date, the 
"SFWebWorkForHireMZ.doc" document was created on the floppy disk years earlier, on May 2, 2003. 
This active file, purportedly from 2003, cannot sit atop two files deleted in February 201 1 , absent some 
sort of system clock manipulation or other fabrication of the files. 

Based on all of this metadata evidence, Stroz Friedberg concluded that the "SFWebWorkForHireMZ.doc" 
file was copied to this floppy disk on or after February 1 8, 201 1 , using a computer whose system clock 
was backdated to May 2, 2003, and then subsequently accessed on a computer whose system clock was 
backdated to April 22, 2003. 



B. The Six Other Versions of the Work For Hire Document Are Backdated 

Stroz Friedberg identified six other modified versions of the Work for Hire Document on a CD produced by 
Mr. Ceglia in Sarasota, Florida. All of these documents display a similar metadata anomaly to the one 
described above: the last printed dates are later than their last modified dates, which is impossible absent 
system clock backdating: 



File Name 


Last Modified 


Last Printed 


work for hire SF template.doc 


04/25/2003 07:47:58 AM 


2/15/2011 


Copy1_work for hire SF template.doc 


04/25/2003 07:50:52 AM 


2/15/2011 


Copy1_XWRL0003.TMP 


04/25/2003 07:50:52 AM 


2/15/2011 


Work for Hire ContractMZ.doc 


04/25/2003 12:16:12 PM 


2/15/2011 


XWRL0004.TMP 


04/25/2003 12:16:12 PM 


2/15/2011 


Copy1_Work for Hire ContractMZ.doc 


04/25/2003 03:38:06 PM 


2/15/2011 



When a Microsoft Word document is printed, the embedded last printed date and time is updated to the 
current time. However, this updated embedded last printed date and time is only maintained in the file if 
the file is saved, which is an act that necessarily updates the last modified date and time as well. Absent 
system clock manipulation, the last printed date of a document cannot be later than the last modified 
date. 

This metadata shows that these versions of the Work for Hire Document were printed on or after February 
1 5, 201 1 , during the pendency of this litigation. In addition, at some point after February 1 5, 201 1 , again 
during the pendency of this litigation, the documents were accessed and saved on a computer whose 
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system clock was backdated to April 25, 2003, a date just prior to the supposed date of the contract on 
which Mr. Ceglia is suing. The backdated documents were then produced to Defendants. 

C. All Seven Versions of the Work For Hire Document Have Significant 
Formatting Differences Between Page 1 And Page 2 

All seven electronic documents are similar to the Work for Hire Document in that they contain significant 
formatting differences between Page 1 and Page 2. Specifically, all seven versions of the Work for Hire 
Document contain margins and formatting on Page 1 that has been manipulated through the manual 
reduction of white space. Thus, more text characters can fit on Page 1 of these documents. 

This formatting is evident in an examination of the margin settings of the documents in Microsoft Word. 
For example, while the margin between the columns on Page 2 of the "Work for Hire ContractMZ.doc" file 
is set to 0.32 inches, the margin between the columns on the Page 1 of that file is set much more 
narrowly to 0.03 inches. Furthermore, in this file the right-hand column on Page 1 is indented to the right 
by 0.13 inches, which increases the number of text characters that could fit on that page. Multiple- 
column, multiple-page documents do not exhibit such margin formatting discrepancies between page one 
and page two by default. Rather, such formatting discrepancies in a document likely result from 
manipulation of the margins by a user. 

There also is a difference in the line spacing of the "Work for Hire ContractMZ.doc" file between the left 
and right columns on Page 1 . While the left-hand column is configured to be single-spaced, a custom 
spacing of .99 spacing is applied to a portion of the right-hand column. This spacing, which is very 
unusual and is slightly tighter than single-spacing, allows more text to fit on the first page. 
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These formatting differences between Page 1 and Page 2 of the modified documents can be seen in this 
screenshot from the document "Work for Hire ContractMZ.doc": 



a)-BV-PURCHASER---Purcha5er-agrees-iIiaT'iiO'furtlierrevL5joii-shaU 
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Fig. 14: Screenshot Showing Document Manipulations 



D. All Seven Versions of the Work For Hire Document Differ From Other 
Contracts Between StreetFax and Third-Parties Found on the Ceglia 
Media 

Stroz Friedberg identified three other contracts related to StreetFax on the Ceglia Media, which 
corroborate the authenticity of the StreetFax Contract and demonstrate the inauthenticity of the Work for 
Hire Document. 

Specifically, Stroz Friedberg found the files REDACTED 

and "2_work for hire SF template.doc" on the Ceglia Media. REDACTED 

, while the third 

document appears to be a template contract document for work on StreetFax by contractors. The 
contracts with Mr. Kato are dated May 5, 2003 and have file system metadata contemporaneous with this 
date. The template contract has metadata that is consistent with it being created on April 25, 2003. As 
such, these contracts are contemporaneous with the April 28, 2003 StreetFax Contract signed by Mr. 
Zuckerberg and Mr. Ceglia. 
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REDACTED 



In addition, one of these documents, "2_work for hire SF template.doc," has 
language that is similar to the StreetFax Contract. Specifically, the language in the "Payment Terms" 
section of the "2_work for hire SF template.doc" file is similar to the "Payment Terms" section of the 
StreetFax Contract. REDACTED 



REDACTED 

On the other hand, the internal formatting of the Work for Hire Document and the 
seven versions of that document is unusual, is not consistent, and appears to have been manipulated to 
permit more text characters to fit on Page 1 . 
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XII. Other Evidence of Electronic Forgery 

Stroz Friedberg found other evidence of electronic forgery on the Ceglia Media. 

A. One of the Versions of the Work for Hire Document Contains Metadata 
That Reveals Mr. Ceglia's Step-By-Step Construction of the Document 

One of the seven versions of the Work for Hire Document previously discussed is the "Work for Hire 
ContractMZ.doc" file. The "Work for Hire ContractMZ.doc" file is a Microsoft Word file that contains what 
appears to be an unsigned copy of the Work for Hire Document. The document was produced by Mr. 
Ceglia on a CD and also was produced by Mr. Ceglia's attorney, Paul Argentieri. 17 

The "Work for Hire ContractMZ.doc" document contains "Last 10 Authors" metadata, which is information 
automatically preserved by older version of Microsoft Word concerning recent editing of the document. 
Specifically, this metadata lists the last ten users to edit the document, as well as the names and 
locations of the file when each user edited it. This metadata reveals who authored or edited a document, 
whether a document's name has been changed over time, and whether a final document was based on 
an earlier document. 



The Last 10 Authors metadata of the "Work for Hire ContractMZ.doc" appears below: 



Author 


Path 


Computer User 


C:\Documents and Settings\GRACE\Desktop\Maybe got it\Page 1\page1feb4threepm.doc 


Computer User 


C:\DOCUME~1\GRACE\Desktop\page1feb4threepm.doc 


Computer User 


C\DOCUME~1\GRACE\LOCALS~1\Temp\AutoRecovery save of MP1 .asd 


Computer User 


C\DOCUME~1\GRACE\Desktop\merged\MP1and2.doc 


Computer User 


C:\Documents and Settings\GRACE\Desktop\merged\Zuck Contract.doc 


Computer User 


C:\DOCUME~1\GRACE\LOCALS~1\Temp\AutoRecovery save of Work for Hire Document.asd 


Computer User 


C:\DOCUME~1\GRACE\Desktop\CONTRA~1\Work for Hire Document.doc 


Paul C 


C:\Documents and Settings\GRACE\Desktop\Finished Docs\Work for Hire Document.doc 


Paul C 


C:\DOCUME~1\GRACE\Desktop\Work for Hire ContractMZ.doc 


Paul C 


A:\Work for Hire ContractMZ.doc 



Fig. 15: Last Ten Authors Metadata of "Work for Hire ContractMZ.doc" 



17 The file names of the two copies of the document are different. The document produced by Mr. Argentieri is 
named "Work for Hire ContractMZ.doc," while the document produced by Mr. Ceglia on a CD is named "Copyl Work 
for Hire ContractMZ.doc." However, Stroz Friedberg determined that the files were identical based on a hash value 
comparison. 
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This Last 10 Authors metadata reveals how the "Work for Hire ContractMZ.doc" file was constructed. The 
first entry in the Last 10 Authors metadata shows a file called "page1feb4threepm.doc" saved in a folder 
on the user's desktop called "Maybe got ifAPage 1 ." It then was saved as a new file, "MP1and2.doc," in a 
new desktop folder called "merged." It then was renamed as "Zuck Contract.doc," moved to a new 
desktop folder called "Finished Docs," and then renamed again as "Work for Hire Contract.doc." The 
document then was saved directly to the computer desktop and to a removable media device (e.g., a 
floppy disk) as "Work for Hire ContractMZ.doc" with an Author "Paul C." 

Based on Stroz Friedberg's experience in electronic forgery cases, the names and paths in the Last 10 
Authors metadata of the "Work for Hire ContractMZ.doc" file reveal an attempt to construct a fraudulent 
document. Specifically, this metadata suggests that the user "Paul C." created a two-page modified 
version of the Work for Hire Document, purportedly dated April 28, 2003, by merging separate pages 
together. The file name also indicates that the initial document was created or edited at 3:00 p.m. on 
February 4. 18 The earliest entry in the Last 1 Authors metadata shows the document as a file in a folder 
called "Maybe got ifAPage 1 ." 

Moreover, the last printed date of the document is February 15, 2011, while the document's last modified 
date is April 25, 2003. As discussed above, absent backdating or manipulation of the system clock, it is 
not possible for a file's last printed date to post-date its last modification date. Therefore, this document 
was fabricated on or after February 1 5, 201 1 . This date is years after the Work for Hire Document was 
allegedly signed and months after Mr. Ceglia filed this lawsuit. 

Furthermore, an entry in the Last 10 Authors metadata of the "Work for Hire ContractMZ.doc" reveals that 
the document was prepared on another computer not yet disclosed or in a user folder later deleted. 
Specifically, the first path present in the Last 10 Authors metadata, "C:\Documents and Settings\GRACE\ 
DesktopWIaybe got ifAPage 1\page1feb4threepm.doc," shows that the file was saved in a folder on the 
desktop of a user named "GRACE." None of the Ceglia Media, which consist of hundreds of pieces of 
media, including computers, hard drives, floppy disks, and CDs, contain a profile for a user named 
"GRACE." Thus, Stroz Friedberg determined that the "Work for Hire ContractMZ.doc" file was edited on a 
computer that was not produced, or on a computer that was produced but from which the "GRACE" user 
profile had been deleted. 



While the year is not present in the file, the February date reflected in the file name is inconsistent with the file 
being created in April 2003 and consistent with the file being created in February 201 1 . Moreover, the last printed 
date of February 1 5, 201 1 establishes that the document was in use in February 201 1 . 
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B. Use of a Hex Editor 

Stroz Friedberg found evidence that a hex editor or similar tool was used on the Ceglia Media to alter 
electronic documents. A hex editor is a type of program that allows a user to edit the binary contents of a 
file, which is the raw data that makes up a file, rather than the text of the file. Hex editors often are used 
to create fraudulent electronic documents because they allow for the manipulation of data at a level that 
makes traditional digital forensic analysis of the alterations to the document more difficult, if not 
impossible, to detect. 

1 . Six Documents Created to Test the Effects of Using a Hex Editor 

Among the documents Mr. Ceglia produced are six Microsoft Word files that were produced on a CD in 
Sarasota, Florida. The file names and paths of those documents appear below: 



File Path 



REDACTED 



The file names, content, and metadata associated with these documents indicate that they were used to 

REDACTED 

First, the file names and paths of the six documents suggest that they were created to REDACTED 



Second, the contents of the documents indicate that they were created to REDACTED 
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REDACTED 



In Stroz Friedberg's experience, electronic forgers commonly use such test documents to test and/or 
conceal the effects of manipulating a document with a hex editor or similar tool. 



2. "SFWebWorkForHireMZ.doc" 



The file "SFWebWorkForHireMZ.doc" - previously discussed as one of the seven backdated versions of 
the Work for Hire Document - also shows evidence of the use of a hex editor or similar tool. The 
document's Last 10 Authors metadata, described above with respect to a different document ("Work for 
Hire ContractMZ.doc"), displays differently when viewed programmatically and manually. 



When viewed programmatically using a software utility like Metadata Assistant, which is a common way to 
view embedded metadata, the Last 10 Authors metadata of the document named 
"SFWebWorkForHireMZ.doc" appears as follows: 



Last 10 authors: 

Has Last 10 Data 

Author: ALS~1YTemp\ALito Recovery save of SF Path: ??????????????????????????? 
??????????????????????????????????????????????????? ???? ?? ?????????????????????????????? 
777777777777777777777777777777777777777777777777777 ???? 77 ?????????????????????????????? 
??????????????????????????????????????????????????? ???? ?? ?????????????????????????????? 
??????????????????????????????????????????????????? ???? 77 ?????????????????????????????? 
????????????????? ???? ?????? ???? ??? ???????????????? ??? ???? ???????????????? ??? ???? ????????? ?? 
??????????????????????????????????????????????????? ???? 77 ?????????????????????????????? 
??????????????????????????????????????????????????? ???? ?? ?????????????????????????????? 
??????????????????? ??? ????????????????? 

??7?7??????7? ??????? ??? ???? ??? ????????????? ??????????????????? A 

Fig. 16: Last 10 Authors Metadata for SFWebWorkForHireMZ.doc 
Viewed with Metadata Assistant 
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In contrast, when viewed manually using the tool EnCase Forensic, the embedded metadata shows that 
that the document named "SFWebWorkForHireMZ.doc" originated as a document in the folder 
"C:\Documents and Settings\iasia\My Documents\StreetFax\ Contracts\WorkForHires" and was authored 
by the user "BRENDAN CEGLIA:" 




Fig. 17: Last 10 Authors Metadata for SFWebWorkForHireMZ.doc 
Viewed with a Forensic Utility 



This shows that embedded metadata about the last ten users to edit the document is available, but only 
when the document is viewed with the use of a digital forensic tool. However, when viewed through 
ordinary means, the metadata is misaligned and not fully available. This suggests that changes have 
been made to the file in such a way that do not preserve its structure, including its metadata fields, which 
is indicative of the use of a hex editor or similar tool to manipulate the file. 



C. Backdating of the System Clock on the Computer that Contained the 
Seagate Hard Drive 

Stroz Friedberg found evidence that the system clock of the computer that contained the Seagate Hard 
Drive was backdated between December 30, 201 and February 1 1 , 201 1 . 19 As described above, this is 
the same computer that contained the StreetFax Contract and the StreetFax Emails. 

Modern Microsoft Windows operating systems - like those operating on the Ceglia Media - automatically 
attempt to set the system clock to the correct time by synchronizing the local computer's system clock 
with a network time server maintained by Microsoft. If the difference between the local system clock and 
the Microsoft network time server is more than 54,000 seconds, or fifteen hours, an error message is 
recorded in the computer's System Event logs. 



Mr. Ceglia did not produce the physical computer that once contained the Seagate Hard Drive. Thus, as explained 
further below, Stroz Friedberg was unable to examine this computer, which might have contained information about 
the system clock settings or that otherwise was relevant to authenticity. 
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Stroz Friedberg analyzed the System Events logs on the Forensic Image Created by Plaintiffs Expert, 
which is a forensic image of the Seagate Hard Drive made on March 29, 201 1 . Those logs contain an 
error message that reveals system clock backdating. Specifically, when the computer's system clock was 
set to November 9, 201 0, it was approximately 8,098,049 seconds, or approximately 94 days, behind the 
time of the Microsoft network time server. 



Event Properties 



_?JxJ 



11/9/201 



Event | 

Date: 
Time: 
Type 
User: 

Computer: OFFICE 2 
Description: 



E Source: W32Time 

5:07:30 PM Category: None 

Error Event ID: 34 
N/A 



The time service has detected that the system time needs to be changed 
by +809S049 seconds. The time service will not change the system time 
by more than +54000 seconds. Verify that your time and time zone are 
correct, and that the time source time.windows.com (ntp.m|0x1 1 
192.168.1. 234: 1 23-> 207. 46. 1 97. 32: 1 23) is working proper ly. 

For more information, see Help and Support Center at 
http: /7go. microsoft, com/fwlink/e vents, asp . 



Da]a: (* Bytes C Words 




OK 



Cancel 



Apply 



Fig. 18: System Event Log from Forensic Image Created by Plaintiff's Expert Showing Backdating 

The actual date and time reported by the Microsoft network server was February 1 1 , 201 1 . This means 
that, sometime on or before February 1 1 , 201 1 , this computer's system clock was backdated 
approximately 94 days to November 9, 2010. 

Stroz Friedberg identified additional anomalies concerning the backdating of the system clock on the 
computer that once contained the Seagate Hard Drive. The Windows XP operating system generates 
limited system backups called "System Restore Points" upon the occurrence of certain events, including 
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the installation of applications and the application of updates to the operating system. The operating 
system sequentially numbers restore points as it adds and removes them from the computer on a first-in, 
first-out basis. As a result, two sequentially-numbered restore points should have chronologically- 
sequential timestamps. 

Stroz Friedberg analyzed the system restore points found on the Forensic Image Created by Plaintiffs 
Expert. Those restore points are not sequential: 



System Restore Point Name 


Restore Point File System Creation Date 


RP1 


12/29/2010 


RP2 


12/30/2010 


RP3 


9/28/2010 


RP4 


11/9/2010 



This evidence indicates that, at some point after December 30, 2010, the computer's system clock was 
backdated to September 28, 2010. 

Based on this evidence of system clock backdating, Stroz Friedberg determined that between December 
30, 201 and February 1 1 , 201 1 , during the pendency of this litigation, the system clock of the computer 
that contained the Seagate Hard Drive was backdated. 
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XIII. Evidence of Spoliation 

Stroz Friedberg found substantial evidence of spoliation on the Ceglia Media. This evidence includes 
multiple reinstallations of the Windows operating system on the hard drives that contained the StreetFax 
Contract. It also includes the deletion of relevant files in February 201 1 and the deactivation of an email 
account in August 201 - both occurring during the pendency of the litigation. 

A. There Were Multiple Reinstallations of the Windows Operating System 
on the Seagate Hard Drive During the Pendency of Litigation 

The installation date of a Windows operating system is tracked in a computer's registry, which is 
comprised of a series of files. The reinstallation of an operating system is a destructive action that may 
have the effect of overwriting existing data on a hard drive. In Stroz Friedberg's experience with 
electronic forgery cases, the reinstallation of an operating system can be done in an effort to destroy or 
conceal data. 

Stroz Friedberg determined that the Windows operating system on the Seagate Hard Drive and the 
Forensic Image Created by Plaintiffs Expert of that drive was reinstalled on at least two occasions. 
Again, the Seagate Hard Drive and forensic image of that drive are the two pieces of Ceglia Media on 
which the StreetFax Contract was found. Both reinstallations were performed during the pendency of this 
litigation, and the second reinstallation occurred at a time when the computer's system clock was 
backdated. 20 

The Forensic Image Created by Plaintiff's Expert has a Windows operating system installation date of 
December 29, 201 0. In addition, the file system metadata of files in the recovery environment on the 
forensic image of the Seagate Hard Drive, which can be used to reinstall the Windows operating system 
on a computer, reflect last accessed dates in late December 2010, which is consistent with an attempt to 
reinstall the operating system at that time. The forensic image of the Seagate Hard Drive was created on 
March 29, 201 1 . Thus, as of March 29, 201 1 , the Seagate Hard Drive itself had a Windows operating 
system reinstallation date of December 29, 2010. 

However, the purported operating system installation date on the actual Seagate Hard Drive at the time it 
was imaged by Stroz Friedberg is not December 29, 2010. Rather, it is two days earlier, December 27, 



The reinstallation of an operating system can be done in a manner that does not delete documents on the hard 
drive. However, even in these circumstances, potentially valuable information, such as system settings or log files, 
may be lost or deleted. In addition, the reinstallation process may overwrite deleted documents or files that otherwise 
would have been recoverable. 
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2010. This means that the Windows operating system was reinstalled on the Seagate Hard Drive for a 
second time, sometime after the imaging occurred on March 29, 201 1 . This reinstallation occurred at a 
time when the system clock of the computer containing the Seagate Hard Drive was backdated to 
December 27, 2010. 

Stroz Friedberg also found Internet history records on the Ceglia Media that reveal web searches that 
may be related to this backdating and reinstallation. On December 28, 2010, a user of the Ceglia Media 
ran a Google search for "when did windows xp release." Then, on January 25, 201 1 , a user of the Ceglia 
Media ran a Google search for "look up the date a hp computer was made." These exploratory searches 
may be indicative of someone conducting research on reinstalling a Windows operating system on a 
computer in a backdated state. In Stroz Friedberg's experience with electronic forgery cases, such 
exploratory research efforts may be conducted in an attempt to avoid obvious backdating errors, such as 
backdating a computer to a date earlier than the date on which the Windows operating system used 
became available. 

Significantly, Mr. Ceglia did not produce the computer that once contained the Seagate Hard Drive. As 
such, Stroz Friedberg was unable to analyze the date and time of the system clock of the computer 
containing the Seagate Hard Drive. Dates and times on digital media are set according to the system 
clock of the computers used to access them. One step in the digital forensic process is to document, 
whenever possible, the date and time of a computer's system clock. This provides digital forensic 
examiners the ability to ascertain and account for any discrepancies between the date and time settings 
of the system clock and the true date and time. Because Mr. Ceglia did not produce the computer 
containing the Seagate Hard Drive, Stroz Friedberg was unable to determine whether that computer's 
clock was accurate. 



B. Deletion of Relevant Files in February 2011 

As discussed above, floppy disks produced by Mr. Ceglia contain records of deleted files named "mark 
emails 082903," "Work for Hire ContractMZ.doc," and "Work for hire SF template.doc." Based on the 
metadata, the deleted files - which in their titles appear relevant to the issues in this case - were last 
accessed on February 1 8, 201 1 . Therefore, the files were deleted on or after that date, during the 
pendency of the litigation. 
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C. Deactivation of Webmail Account in August 2010 

As discussed below, Mr. Ceglia failed to disclose several webmail accounts, including the Yahoo! account 
"landlubber39@yahoo.com," for which he is the registered account holder. This webmail account was 
closed by Yahoo! on August 4, 2010, at Mr. Ceglia's request. When the account was closed on August 4, 
201 - more than a month after the initial complaint was filed - Mr. Ceglia was notified that Yahoo! would 
delete the content of the webmail account in 90 days. Although Stroz Friedberg received data from this 
account from Yahoo!, Stroz Friedberg did not identify any evidence that Mr. Ceglia took action to preserve 
the email in this account. 

D. Deletion of Data from getzuck@gmail.com Webmail Account 

As previously discussed, Stroz Friedberg identified the existence of a webmail account 
getzuck@gmail.com through an analysis of Internet history on the eMachines computer. Specifically, the 
Internet history showed that the Ceglia Media was used on April 18, 201 1 to read an email related to the 
activation of a Facebook account for the email address getzuck@gmail.com. Thus, this email address 
was in use in April 201 1 and presumably contained emails from that time period. 

Stroz Friedberg received a production of the getzuck@gmail.com webmail account from Google pursuant 
to Mr. Ceglia's consent. Upon analysis, Stroz Friedberg determined that the earliest email in this account 
dated from January 28, 201 2. This fact, coupled with the fact that the email account was in use well 
before that date, suggests that the earlier email data was deleted from this account. 
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XIV. Evidence of Undisclosed Media 

Stroz Friedberg found evidence of several removable storage devices and webmail accounts on the 
Ceglia Media that Mr. Ceglia did not turn over or identify. 



A. Undisclosed Removable Storage Devices (USBs) 

Stroz Friedberg found evidence of six electronic media that were not produced by Mr. Ceglia. The 
undisclosed media appear to be USB devices, which are removable data storage devices used to save 
and transport data. At least one of these devices was used as recently as April 4, 201 1 , and three of the 
six devices were used during the pendency of this litigation. 

When a USB device is plugged into a computer running a modern version of Microsoft Windows, the 
operating system records the first time the device was connected in both the Windows Registry, which is 
a database of operating system and user settings, and in log files named "setupapi.log" or 
"setupapi.dev.log." The Windows Registry files and "setupapi" logs of the Ceglia Media contain evidence 
that the following six USB devices were connected to those computers or hard drives: 



Device Name 


Internal Identifier 


Gigaware USB Device 


20051 942520C8D20CDB2&0 


Seagate FreeAgent GoFlex USB Device 


NA056T98&0 


SanDisk Cruzer Micro USB Device 


20052443901 6A861 22A2&0 


USB 2.0 USB Flash Drive USB Device 


76562f5793a65e&0 


Ut165 USB2FlashStorage USB Device 


00000000000069&0 


Kingston DataTraveler 2.0 USB Device 


5B8407000A4B&0 



Mr. Ceglia did not produce any of these six USB devices to Stroz Friedberg. 

Through an analysis of the "setupapi.log" and "setupapi.dev.log" files, Stroz Friedberg determined that the 
Seagate FreeAgent GoFlex USB Device, internal identifier NA056T98&0, had been connected to Mr. 
Ceglia's Toshiba Satellite laptop computer as recently as April 4, 201 1 . In addition, two other removable 
devices were connected as recently as June 30, 201 0. Below is a chart documenting the connections of 
the undisclosed devices to the Ceglia Media on or after June 30, 201 0: 
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Device Name 


Internal Identifier 


Ceglia Media 


Date of Connection 


Gigaware USB Device 


20051 942520C8D20CDB2&0 


Toshiba Satellite Laptop 


9/1 6/2010 


Gigaware USB Device 


20051 942520C8D20CDB2&0 


eMachines Desktop 


8/17/2010 


SanDisk Cruzer Micro USB Device 


20052443901 6A861 22A2&0 


Forensic Image 

Created by Plaintiff's Expert 


12/29/2010 


SanDisk Cruzer Micro USB Device 


20052443901 6A861 22A2&0 


Toshiba Satellite Laptop 


12/22/2010 


SanDisk Cruzer Micro USB Device 


20052443901 6A861 22A2&0 


eMachines Desktop 


7/28/2010 


Seagate FreeAgent GoFlex 


NA056T98&0 


Seagate Hard Drive[2] 


12/31/2010 


Seagate FreeAgent GoFlex 


NA056T98&0 


Toshiba Laptop[1] 


4/4/201 1 



Through an analysis of link files, Stroz Friedberg also determined that the undisclosed USB devices 
contain relevant electronic documents. Link files are shortcuts to files or folders created so that these 
files and folders are readily available to a user. When a file is opened or viewed using a Windows 
operating system, a link file typically is created that points to the file or folder that is being accessed (the 
"target file" or "target folder"), and multiple link files may target the same file or folder. Although link files 
may not provide a complete history of every document that is viewed during the lifespan of the computer, 
they generally provide information about the recent activity performed by each user. 

Link files contain embedded information about the files or folder they target. This information includes, 
among other things, the name and path, or location, of the target file or folder on the hard drive. Link files 
also record a snapshot of the metadata associated with the target file or folder at the time the link file was 
created, including the created, last written, and last accessed dates associated with the target file or 
folder. 

On the Toshiba Satellite laptop computer, there were link files to files named "Zuckerberg Contract 
pagel .tif" and "Zuckerberg Contract page2.tif." The embedded metadata of these link files show that they 
point to target files on a removable device, such as a USB flash device, that are in a folder named 
"Facebook Files." Moreover, the metadata for the two images embedded within the link files shows that 
the images were created on July 9, 201 0. Thus, there is clear evidence that at least one of the 
undisclosed pieces of media contained electronic documents that are relevant to this litigation and that 
were not found anywhere else on the Ceglia Media. 

In his August 29, 201 1 declaration, Mr. Ceglia stated that these files were contained on the Gigaware 
USB Device that bore serial number 20051 942520C8D20CDB2&O. (Ceglia August 29, 201 1 Declaration, 
Doc. No. 132, at 1132). 
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In sum, Stroz Friedberg's analysis revealed the existence of six removable devices that were not turned 
over or identified by Mr. Ceglia. Some of those devices contain or contained relevant electronic 
documents. One of those devices was used as recently as April 201 1 . 

B. Undisclosed Webmail Accounts 

Stroz Friedberg found evidence of the use of four undisclosed webmail accounts in the Internet history on 
the Ceglia Media, none of which had been identified by Mr. Ceglia to the Court or the Defendants prior to 
their discovery by Stroz Friedberg. These accounts were used or appear to be associated with Mr. 
Ceglia, and some were used as recently as April 201 1 . 

When a user visits a website, the web browsing activity may be logged by the Internet browser in an 
Internet history file. The Internet history on the Ceglia Media shows four undisclosed email addresses 
that appear to be associated with Mr. Ceglia: landlubber39@yahoo.com; paulc@hush.com; 
getzuck@gmail.com; and alleganypellets@gmail.com. 

The available information regarding these four undisclosed email accounts is as follows: 

• The Internet history records show multiple uses of the email account landlubber39@yahoo.com 
by a user of the Ceglia Media. Furthermore, an August 4, 201 email regarding the closing of the 
account was sent to the registered user of the account at paulceglia@msn.com, an email address 
that belongs to Mr. Ceglia. The Internet history records also show that the Yahoo! account 
contains relevant information, as it was used to correspond about this case in July 2010. 

• The undisclosed Hushmail account paulc@hush.com appears to have been created on 
November 1 , 201 0. Hushmail is a webmail provider that specializes in providing encrypted and 
secure webmail services to its users. 

• The Internet history records on the Ceglia Media show that the email account 
getzuck@gmail.com was visited by a user of the Ceglia Media on April 1 8, 201 1 to read an email 
asking for an address confirmation for a Facebook membership. 

• Based upon the title of a webpage visit recorded by the Internet history of the Ceglia Media, the 
alleganypellets@gmail.com webmail account was accessed using the Ceglia Media as recently 
as July 15, 2010. 
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These email accounts were not disclosed in Mr. Ceglia's declaration pursuant to the Court's Orders prior 
to their identification by Stroz Friedberg. 

C. Recovered Deleted Files 

Mr. Ceglia produced a CD that contains multiple files with files beginning with "X," such as the file 
"XWRL004.TMP." This file naming convention suggests that these files are recovered versions of files 
that had been deleted from one or more other storage devices and burned to this CD. 

Microsoft Word can create temporary files with file names of the following convention: "~WRL###.TMP." 
For example, "-WRL004.TMP" is a file name that would match this convention. However, the file named 
"XWRL004.TMP" appears to be a Microsoft Word temporary file that does not follow this file naming 
convention, in that it begins with an "X" rather than a 

When files are deleted from storage media that uses the FAT file system, the first character of the file 
name is overwritten. Since that information is no longer available, it is common for data recovery 
programs to prompt the user to specify a replacement first character when a recovery attempt is made. 
Here, multiple files on the floppy disk with names beginning with "X," such as the file named 
"XWRL004.TMP," suggest that a data recovery was performed and that the user who performed the data 
recovery chose "X" to replace the overwritten first characters of the file names. Furthermore, the data 
recovery effort was performed on a device or devices other the CD, as CDs do not have FAT file systems. 

The CD containing these files had a volume label of "PAUL_3_23_1 1 ." The volume label and the CD 
metadata indicate that the CD was created on March 23, 201 1 , during the pendency of this litigation. 

No corresponding copy of the recovered file "XWRL004.TMP" was present anywhere else on the Ceglia 
Media. The existence of a recovered deleted file on a CD created after the litigation was initiated, with no 
corresponding file on a produced computer or removable storage device, suggests that the source of this 
recovered deleted file has not been produced. 
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XV. Evidence Rebutting Paul Ceglia's Allegations 

Based on the totality of the digital forensic evidence, Stroz Friedberg has determined that the StreetFax 
Emails and the attached StreetFax Contract are authentic. The digital forensic evidence shows that the 
pages of the StreetFax Contract are scanned images of a paper document, dated April 28, 2003, between 
Mr. Zuckerberg and StreetFax; that the scanned images were created on the Ceglia Media on March 3, 
2004; and that the scanned images were sent as attachments to two emails from ceglia@adelphia.net to 
jkole@sidley.com on March 3, 2004. 

Stroz Friedberg understands that Mr. Ceglia has argued that the StreetFax Contract is fabricated and 
forged. Specifically, Mr. Ceglia stated that the StreetFax Contract is a "doctored," "photoshopped" image 
that Mr. Zuckerberg or the Orrick law firm "planted" on his computers. Mr. Ceglia's attorney, Dean 
Boland, also stated that the StreetFax Contract is "obviously forged." Mr. Ceglia stated that he "[does] not 
recall authoring or sending the [StreetFax Emails and StreetFax Contract] to Jim Kole." (Ceglia 
November 1 7, 201 1 Declaration, Doc. No. 230, at f 7). Finally, Mr. Ceglia implied that Mr. Zuckerberg 
personally sent the StreetFax Contract to Mr. Kole, stating that "Mark Zuckerberg [] had all the credentials 
necessary to access and to send and receive email via my father's ceglia@adelphia.net email account." 
(Id- at |21). 

These statements are contradicted by the evidence described in this report, which indicates that Mr. 
Ceglia sent the StreetFax Emails and the StreetFax Contract to Mr. Kole on March 3, 2004. In addition, 
Stroz Friedberg found no evidence on the Ceglia Media to support these assertions by Mr. Ceglia and his 
counsel. 

To begin, it would be extraordinarily difficult for an individual, even a person with significant technical 
expertise, to "plant" the StreetFax Emails on the Ceglia Media or Sidley Austin's servers. And it would be 
even harder to "plant" the StreetFax Emails in both locations. 

Initially, a person attempting to fabricate and "plant" the StreetFax Emails would have to correctly guess 
numerous authenticating details. For example, the person would have to know or guess about the 
existing relationship between Mr. Ceglia and Mr. Kole and have Mr. Kole's correct email address at Sidley 
Austin. He or she also would have had to know or correctly guess the telephone number set forth in the 
body of the first StreetFax Email. 

In addition, the person would have had to create metadata consistent with authentic emails in a way that 
could not be detected through digital forensic analysis. The person would have had to generate metadata 
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for both of the StreetFax Emails, including creation dates and last modified dates, that are consistent with 
the emails having been sent on March 3, 2004. 

The person would then have had to insert the StreetFax Emails in the two different container files in which 
they were found: the "Sent Items. dbx" file on the Ceglia Media and the Microsoft Outlook PST file on a 
Sidley Austin server, again in a way that could not be detected through digital forensic analysis. These 
container files were stored on hard drives controlled by Mr. Ceglia and Sidley Austin, respectively. The 
person would have had to insert the StreetFax Emails in these container files without altering the 
metadata on those container files as well. 

Stroz Friedberg also found separate corrobating evidence, in an application called Google Desktop, 21 that 
the StreetFax Emails have existed on the Seagate Hard Drive since at least July 2007. Based on the file 
system metadata of the files associated with the Google Desktop application, it appears that the 
application was used on the Seagate Hard Drive between October 23, 2006 and July 1 1 , 2007. Thus, 
there is historical information that establishes that the StreetFax Emails existed on the Seagate Hard 
Drive since on or before July 1 1 , 2007. The Google Desktop index represents another area in which the 
references to the StreetFax Emails would have to have been inserted, again in a way that could not be 
detected through digital forensic analysis. 

Even if that could all be accomplished, the person would have had to create fraudulent Internet headers, 
reflecting the transmission of the StreetFax Emails through the Internet. This would require a significant 
amount of authenticating detail. For example, the person creating the Internet headers would have had to 
know or guess that Adelphia was Mr. Ceglia's Internet service provider. The person also would have had 
to know or guess the names and IP addresses of two different servers at Sidley Austin. 

Taken together, to accomplish all of these required steps on multiple machines, without detection, would 
be extremely difficult. 

There is no digital forensic evidence to support the speculation that these files were "planted" on the 
Ceglia Media and a Sidley Austin server. This explanation for the existence of the StreetFax Contract 
and StreetFax Emails on the Ceglia Media and on a Sidley Austin server is neither reasonable nor 
supported by any evidence. Based on the digital forensic evidence, Stroz Friedberg has determined that 
there is only one plausible explanation for the existence of the StreetFax Contract and StreetFax Emails 



The Google Desktop application allows a user to efficiently search a computer for files containing specific keywords 
and review those documents within the application. The application does so by building a searchable database, or 
index, of the contents of the files on the computer and allowing a user to search this database through the Google 
Desktop interface. For purposes of Stroz Friedberg's digital forensic analysis, the Google Desktop index provides 
historical evidence of what files existed on the Seagate Hard Drive at the point in time when Google Desktop last 
indexed the files. 
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on the Ceglia Media and a Sidley Austin server: they were saved to the Seagate Hard Drive and then, 
within minutes, were sent from an Outlook Express client on the computer containing that hard drive, 
using the Adelphia email account, to Mr. Kole at Sidley Austin, on March 3, 2004. 

Mr. Ceglia also has implied that Mr. Zuckerberg accessed the Adelphia email account and personally sent 
the StreetFax Contract to Mr. Kole on March 3, 2004. In order to have sent the StreetFax Contract and 
StreetFax Emails to Mr. Kole, Mr. Zuckerberg would have had to, at the very least, gain physical or 
remote access to and control over the desktop computer containing the Seagate Hard Drive, which was 
located in upstate New York. In addition, based on the digital forensic evidence, this activity would have 
had to occur on March 3, 2004. Stroz Friedberg did not identify any digital forensic evidence that Mr. 
Zuckerberg accessed the desktop computer containing the Seagate Hard Drive, either physically or 
remotely, on March 3, 2004. This explanation for the existence of the StreetFax Contract and StreetFax 
Emails on the Ceglia Media and on a Sidley Austin server is neither reasonable nor supported by the 
evidence. 
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XVI. Conclusion 

Stroz Friedberg found direct and compelling digital forensic evidence that the documents relied upon by 
Mr. Ceglia to support his claim are forged. Stroz Friedberg also found what it believes to be the authentic 
contract between Mr. Ceglia and Mr. Zuckerberg. That contract contains no references to Facebook. 



We declare under penalty of perjury that the foregoing is true and correct 




Michael F. McGowan 
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Exhibit A 
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CO-PRESIDENT 



PROFESSIONAL EXPERIENCE 

STROZ FRIEDBERG 
Co-President 
New York, NY 

Joined firm January 2001 

Responsible for overall management of international consulting and technical 
services firm with offices in New York, Washington D.C., Los Angeles, London, 
Boston, Dallas, San Francisco, and Minneapolis, specializing in digital forensics, 
cyber-crime and data breach response, electronic discovery, and business 
intelligence and investigations. Led M&A processes for identifying, acquiring, 
and integrating Docuity, Inc. (an electronic discovery processing and hosting 
company) and Data Genetics International, L.P. (a U.K. digital forensics firm). 
Negotiated and structured major private equity investments made in Stroz 
Friedberg by Green Capital Partners ($30mm, 2007; $7mm follow-on, 2008) and 
New Mountain Capital ($1 1 5mm, 201 0). 

National leader in responding to all forms of computer crime and abuse, including 
cyber-extortions, theft of trade secrets, industrial and state-sponsored espionage, 
leaks of confidential information, hacks and unauthorized access, denial of service 
attacks, illegal electronic surveillance, domain name hacks, key-logging, and 
Internet-based harassment. 

Has managed numerous digital forensic assignments for major law firms, 
corporations, and government agencies in criminal, civil, regulatory, and internal 
corporate matters, including cases involving alleged wiping and mass deletion of 
data; spoliation, e-forgery, and backdating; computer-enabled theft of trade 
secrets; and espionage, illicit images, harassment, and hacking. 

Leader in electronic discovery consulting; author of book chapters and scholarly 
articles on eDiscovery strategy and technology. Has managed numerous 
electronic discovery projects in civil and regulatory proceedings, many of which 
were global in scope and required the preservation, processing, and production of 
electronic data from hundreds of computers, servers, cell phones and PDAs, 
backup tapes, enterprise databases, and removable media. 

Court-appointed consultant to the Special Master in Advanced Micro Devices v 
Intel Corp., No. 05-441 -JJF (D. Del.); court-appointed third-party electronic 
discovery/digital forensics expert in Four Seasons Hotels v Consorcio Barr, No. 
01-4572-CIV (S.D. Fla.); and Harvest Court v Nanopierce, No. 602281-01 (New 
York Supreme Court). 

Significant matters include: 

• Led digital forensics team that analyzed the proprietary source code 
behind Google's WiFi router-mapping software. Lead writer of report to 
world-wide Data Privacy Authorities, the F.T.C., and the public 
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addressing concerns that the source code captured private user 
communications and data. See: 

http://static.googleusercontent.com/external content/untrusted dlcp/ww 
w.google.com/en//googleblogs/pdfs/friedberg sourcecode analysis 060 
910.pdf 

• Led four-year effort to preserve, cull, search, and produce ESI for an 
insurance company in response to an Attorney General's criminal 
subpoenas and related civil actions. Oversaw preservation and 
production of data from hundreds of custodians, servers, and other data 
sources. Served as company's 30(b)(6) witness in securities class 
action law suit. Provided strategic advice, affidavits, and testimony 
regarding reasonableness of preservation and production efforts. 

• Solved case in which ex-employees were for six months remotely 
accessing without authorization the e-mail of the Chairman, legal 
counsel, and in-house investigator of a public company. Oversaw 
development and production of evidence, including log analysis; initiated 
and conducted liaison with U.S. Secret Service, which led to prosecution 
and conviction of the offender. 

• Led digital forensics team in analysis of an investment banker's multiple 
laptop computers, determining that a critical memorandum accusing 
another banker of foreign corrupt practices violations was forged. Expert 
report led investment banker to confess. 

• Led digital forensic team in analyzing an intrusion into an FTP server on 
which protected customer identity data was stored. Concluded that 
intruder did not access customer data, facilitating decision by company 
to not report under data breach notification statutes. 

• Led investigative team in determining who leaked sensitive internal 
company e-mails and information to Wall Street analysts covering the 
company. Oversaw forensic analysis of subjects' computers and 
matched snail-mailed information received by analysts to data on the 
computer of a single subject within the corporation. Oversaw linguistic 
analysis of snail-mailed cover letter to analysts. Matched linguistic 
anomalies to anomalies in known writings of the subject. Oversaw 
private investigation which led to a postal clerk who identified the 
subject's father as the person who snail-mailed the letters in question. 

• Led digital forensic examination of two laptop computers belonging to a 
CFO in an internal investigation into "trading with the enemy" allegations. 
Established that just before he relinquished his computers to 
investigators, the CFO deleted folders relating to trading with Iran. 
Conclusions supported termination for cause. 
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• Oversaw preservation, culling, and processing of laptop, desktop, server, 
PDA, and removable media data from over 60 lawyers and paralegals in 
six of a major law firm's domestic offices, in response to a threatened 
malpractice case. Developed a methodology for conducting an 
electronic discovery project within a law firm environment, where there 
are unique issues relating to commingled, privileged data. 

• Oversaw development of proprietary techniques to conduct key-word 
search of Korean-language data in an antitrust inquiry. Oversaw the 
establishment of an on-site laboratory in Seoul to facilitate confidential 
data processing. 

• Oversaw multi-year electronic discovery project for Audit Committee of a 
public company in an accounting fraud scandal. Gathered and 
processed data from over 550 custodians for response to regulatory and 
civil subpoenas. Conducted deep forensic analysis relating to possible 
illegal destruction of data. 

• Led cyber-crime response team in identifying location within a corporate 
network of illegally installed "sniffer" program that was covertly capturing 
corporate instant message traffic. Led forensic team in analyzing laptop 
on which sniffer was running to identify internal employees who installed 
sniffer and accessed sniffed IMs. Conducted interviews of multiple IT 
staff members, obtaining confessions from some and exonerating others 
in illegal scheme. 



UNITED STATES ATTORNEY'S OFFICE, E.D.N.Y. 

Senior Litigation Counsel, November 1999 to December 2000 

Computer and Telecommunications Coordinator, December 1997 to December 2000 

Chief, Narcotics Unit, December 1994 to November 1997 

Deputy Chief, Narcotics Unit, January 1993 to November 1994 

Line Assistant, April 1 989 to December 1992 

New York, NY 



As Computer and Telecommunications Coordinator: 

• Investigated and prosecuted cases involving computer hacks, denial of 
service attacks, Internet-related trade secret theft, criminal trademark 
and copyright infringement, computer hardware and software 
counterfeiting, telecommunications billing fraud, and illegal electronic 
surveillance. 

• Participated in the establishment of enforcement policy, built 
relationships with client agencies, and supervised up to five Assistant 
U.S. Attorneys. 
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• Investigated telecommunications fraud case using one of the first 
government e-mail wiretaps. 

As Chief of Narcotics and in other positions: 

• Investigated, litigated, and handled appeals of complex cases involving 
narcotics trafficking, money laundering, drug-related violence, 
racketeering, securities fraud, and public corruption. Numerous trials, 
ranging from one to eight weeks in length. 

• Participated in the establishment of narcotics and money laundering 
enforcement policy, built relationships with client agencies, and 
supervised up to 15 Assistant U.S. Attorneys and two Deputy Chiefs. 

• Received 1 994 Department of Justice Award for Superior Performance 
for investigation and prosecution of six accomplices in Cali Cartel- 
ordered assassination of Manuel de Dios Unanue, the former editor-in- 
chief of El Diario. 

SKADDEN, ARPS, SLATE, MEAGHER & FLOM LLP 
Associate Attorney, Litigation Department 
New York, NY 

1 983 to 1 989 

Participated in all phases of intellectual property, takeover, general commercial, 
and product liability litigation, including two jury trials and several preliminary 
injunction hearings. 



EDUCATION 

BROOKLYN LAW SCHOOL 

J.D. 1983, magna cum laude 

BRANDEIS UNIVERSITY 

B.A. Philosophy, 1978, cum laude 
Varsity soccer, 1973, 1974, 1975 



PUBLICATIONS 

March 2008: New Electronic Discovery Teams, Roles & Functions, a white paper 
published by The Sedona Conference. 

October 2006: Co-authored "Lost Back-up Tapes, Stolen Laptops and Other 
Tales of Data Breach Woe," an article published in Computer and Internet 
Lawyer. 



32 Avenue of the Americas, 4th Floor, New York, NY 1 001 3 

Tel: 212.981.6536 ■ Fax: 212.981 .6545 ■ efriedberg@strozfriedberg.com ■ www.strozfriedberg.com 



-00569-RJA -LGF Document 325 

ERIC M. FRIEDBERG 

CO-PRESIDENT 



Filed 03/26/1 2 Page 66 of 1 02 



September 2005: Co-authored "Electronic Discovery Technology," Chapter Nine 
in Adam Cohen and David Lender's treatise Electronic Discovery: Law and 
Practice. 

July 2005: To Recycle or Not to Recycle, That Is The Hot Backup Tape Question, 
a white paper published in the Practicing Law Institute's Fifth Annual Municipal 
Law Institute course materials. 

May 2004: Co-authored "Your Company's Computer System," Chapter One in 
the book E- Discovery: A Guide for Corporate Counsel, published by Sills 
Cummis Epstein & Gross P.C. 

January 2004: "To Cache a Thief: How Litigants and Lawyers Tamper with 
Electronic Evidence and Why They Get Caught," an article published in The 
American Lawyer magazine. 

November 2003: Co-authored "21st Century Forensics: Searching for the 
'Smoking Gun' in Computer Hard Drives," an article published in The Prosecutor, 
the monthly publication of the National District Attorneys Association. 



LECTURES 

July 2010: Led Information Systems Security Association (ISSA) industry 
webinar entitled "Social Networking Forensics". 

January 2009: Presented a lecture entitled "New Electronic Discovery Teams, 
Roles, & Functions" at the Association of the Bar of the City of New York. 

2008: Participated in a panel discussion entitled "Digital Forensics: From 
Investigation to the Courtroom" at the Cyberlaw: Expanding the Horizons 
Conference, hosted by the American Bar Association in Washington, DC. 

June 2008: Participated in a panel discussion entitled "Data Breach Investigation 
and Response" at the Practical Privacy Series, hosted by the International 
Association of Privacy Professionals (IAPP). 

May 2008: Led a panel discussion entitled "Barbarians at the Cybergate" at the 
New York CIO Executive Summit. 

May 2008: Participated in a panel discussion entitled "Forensics, an Executive 
Overview" at the CISO Executive Forum, hosted by the Information Systems 
Security Association (ISSA). 

April 2008: Participated in a panel discussion entitled "E-Discovery in Insurance" 
at the Electronic Discovery Seminar, hosted by DRI. 
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March 2008: Participated as a Faculty Member for the Sedona Conference 
Institute event in San Diego, California, entitled "Second Annual Program on 
Getting Ahead of the e-Discovery Curve: Strategies to Reduce Costs and Meet 
Judicial Expectations" and as a panel member for presentations entitled "New 
Roles and New Teams to Meet ESI Production Obligations/ Expectations" and 
"Effective Preparation by Requesting Party for Rule 26 (f) Conferences." 

January 2008: Led a panel discussion entitled "Electronic Discovery: Technology, 
Strategy & Emerging Standards" at the Association of the Bar of the City of New 
York. 

November 2007: Participated in a panel discussion entitled "Preservation: From 
Legal Holds to Preservation Methodologies" at the Advance E-Discovery 
Technology Workshop at Georgetown University Law Center. 

September 2007: Led a panel discussion entitled "Cyber-crime: The Insider 
Threat" for the New York Chapter of the Association of Corporate Counsel of 
America (ACCA). 

June 5, 2007: Delivered a lecture on "The Challenges Confronting the Digital 
Forensics Community" to The National Academies' Committee on Identifying the 
Needs of the Forensic Sciences Community. 

June 2007: Participated in a panel discussion for The Association of Corporate 
Counsel of America (ACCA) 2007 Ethics Marathon at Pfizer Corp. 

June 2007: Participated in a panel discussion entitled "Computer Forensics and 
Auditing" for the ABA. 

March 29, 2007: Participated as a Faculty Member for the Sedona Conference 
Institute event in Memphis, Tennessee, entitled "Getting Ahead of the e- 
Discovery Curve: Strategies for Companies & Their Counsel to Reduce Costs 
and Meet Judicial Expectations" and as a panel member for a presentation 
entitled "Changing Corporate Culture: Creating & Managing New Relationships to 
Effectively Respond to Discovery & Investigations." 

February 21 , 2007: Led a panel discussion entitled "Compliance: Using 
Computer Forensics to Ensure Process/Protocol" for the members of the Greater 
New York Chapter of the ACCA. 

December 6, 2006: Participated in a panel discussion entitled "Fundamentals of 
e-Discovery" for the New York State Bar Association. 

December 5, 2006: Participated in a panel discussion entitled "Identity Theft: 
Understanding the New Laws and Ways to Protect Your Clients and Yourself 
from Becoming a Victim" at the Association of the Bar of the City of New York. 
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November 29, 2006: Participated in a webinar entitled "Proskaueron Privacy: 
The Government and Privacy." 

November 10, 2006: Participated in a panel discussion entitled "Forensics in e- 
Discovery" at Georgetown University Law Center. 

November 6, 2006: Delivered a lecture entitled "Data Breach Notification: 
Technology, Strategy, and Law" to the members of the ACCA of Greater N.Y. 

March 16, 2006: Delivered a lecture entitled "Computer Forensics: Technology, 
Strategy and Law" to the Communications and Media Law Committee of the New 
York City Bar Association. 

February 2, 2006: Delivered a lecture entitled "Computer Forensics: Technology, 
Strategy and Law" at Brooklyn Law School. 

March 16, 2005: Delivered a lecture entitled "Computer Forensics: Technology, 
Strategy and Law" to the Communications and Media Law Committee of the New 
York City Bar Association. 

October 27, 2005: Participated in a panel discussion on "Electronic Discovery in 
Litigation and What It Means for the European Company" at the Fall 2005 
meeting for the International Section of the American Bar Association. 

July 27, 2005: Gave a presentation on "Electronic Discovery" for the Practicing 
Law Institute's Fifth Annual Municipal Law Institute. 

April 6, 2005: Participated in a panel presentation with Hon. Shira A. Scheindlin, 
U.S. District Judge, Southern District of New York; Hon. Ira Warshawsky, 
Supreme Court Judge, Nassau County; and David J. Lender, Esq., Weil Gotshal 
& Manges LLP, on "E-Discovery: The Basics and Beyond" at the New York State 
Judicial Institute. 

February 23, 2005: Delivered a lecture entitled "Computer Forensics in Support 
of Litigation" to the Association of the Bar of the City of New York 

January 12, 2005: Gave a presentation entitled "Handling Child Pornography 
Discovered During a Forensic Examination" at the Quarterly Meeting for the New 
York Electronic Crimes Task Force (NYECTF) of the U.S. Secret Service and 
John Jay College of Criminal Justice. 

October 1 , 2004: Delivered a lecture entitled "To Cache a Thief: E-Evidence 
Tampering," which addressed using computer forensics to determine whether 
electronic documents were tampered with or are authentic, at the Association of 
Legal Administrators Region 5 Educational Conference. 
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CO-PRESIDENT 

EXPERT TESTIMONY 

November 2007: Testified as a 30(b)(6) witness for American International Group 
in a securities class action. 



PRO BONO 

Member, Advisory Committee to the President of Brooklyn Law School. Advise 
President on strategic issues relating to positioning, marketing, recruiting, retention, 
and fundraising. 

Consultant to the Global Network Initiative (GNI), an international consortium of 
communication and information providers, human rights groups, and academics 
committed to upholding global human rights norms, privacy rights, and freedom of 
expression in the electronic sharing and transmission of information. Assist GNI 
in developing a practical mechanism to monitor members' compliance with GNI 
principles without compromising private information, legitimate government 
requests for information, and efficient business functions. Advise on impact of 
domestic and foreign privacy laws, including ECPA, FISA, Title III, grand jury 
secrecy laws, and law enforcement power to compel secrecy, including in 
connection with search warrants, grand jury subpoenas, criminal and national 
security wiretaps, and NSLs. 



PROFESSIONAL AFFILIATIONS 



• Member, International Association of Privacy Professionals 

• Former member, The Sedona Conference Working Group on Electronic 
Discovery 

• Former member, E-Discovery Subcommittee of the New York State Bar 
Association's Commercial and Federal Litigation Section 

• Former Member, Information Technology Law Committee of the New 
York City Bar Association 
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MANAGING DIRECTOR 

PROFESSIONAL EXPERIENCE 

STROZ FRIEDBERG, LLC 
Managing Director 
New York, NY 

2005 to Present 

Supervise digital forensic, electronic discovery, and cyber-crime response cases 
in the firm's New York City office. Head the firm's New York City office and 
supervise that office's Digital Forensic Examiners. Oversee and work on an 
active case load of digital forensic, cybercrime response, electronic discovery, 
and private investigations assignments. Give Continuing Legal Education 
lectures to law firms and government clients. Significant cases include: 

• Oversaw the on-site preservation and harvesting in Mexico of sensitive 
and confidential electronic data from a server and scores of laptops, 
desktops, and removable storage devices for a multi-national corporation 
in a high-stakes civil litigation. Supervised on-site processing to facilitate 
attorney review and to protect the confidentiality of extremely sensitive 
client documents. 

• Led incident response in a high-profile data breach and computer crime 
investigation. Helped determine the nature and scope of the attack and 
identify potentially-compromised customer data. Assisted inside and 
outside counsel in formulating responses to regulatory and other 
inquiries. 

• Helped lead global electronic discovery consulting project for a Fortune 
1 company. Assessed and catalogued the kinds and sources of 
electronic data maintained by the company and consulted on the proper 
handling of that electronic data, including compliance with litigation holds 
and other retention obligations. Prepared litigation-response plans to 
coordinate consistent disclosures about electronic data in a litigation 
context and to ensure the proper preservation and production of 
electronic data in criminal, civil, and regulatory matters. 

• Spearheaded a team of digital forensic examiners and private 
investigators that preserved and analyzed network security logs to 
identify the source, duration, and extent of an unauthorized access into 
corporate file servers and, armed with that forensic proof, obtained a 
confession from an ex-employee of the corporation. 

• Provided consulting services to a Fortune 500 company whose 
confidential data had been lost by a third party due to the theft of a 
laptop. Reviewed the security procedures used to determine what 
confidential information had been on the stolen laptop, thereby providing 
the company with important assurances that it had taken reasonable and 
adequate steps to identify the lost confidential information. 
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MANAGING DIRECTOR 



• Supervised the examination and analysis of key emails in a high-profile 
criminal investigation that established that the crucial emails were 
authentic. 

UNITED STATES ATTORNEY'S OFFICE, E.D.N.Y. 
Assistant United States Attorney 
Brooklyn, NY 

2002 to 2005 

Investigated, litigated, and handled appeals of complex criminal cases involving 
narcotics trafficking, money laundering, drug-related violence, racketeering, 
organized crime, and terrorism as a member of the General Crimes, Narcotics, 
and Violent Crimes & Terrorism Sections. Conducted numerous trials, ranging 
from one to six weeks in length. 

SOLICITOR GENERAL, OFFICE OF THE ILLINOIS ATTORNEY GENERAL 
Assistant Attorney General 
Chicago, IL 

2000 to 2002 

Handled appeals in complex civil cases involving constitutional law, statutory 
construction, government contracts, and tort liability. Briefed and argued 
numerous cases before both state and federal courts of appeals. 

THE HONORABLE JOEL M. FLAUM, CHIEF JUDGE, UNITED STATES 
COURT OF APPEALS FOR THE SEVENTH CIRCUIT 
Law Clerk 
Chicago, IL 

1 999 to 2000 

Prepared memoranda and assisted in drafting opinions in civil and criminal 
matters briefed and argued before the United States Court of Appeals for the 
Seventh Circuit. 



EDUCATION 

UNIVERSITY OF VIRGINIA SCHOOL OF LAW 

J.D. 1999, with High Distinction 
Editor-in-Chief, Virginia Law Review 
Order of the Coif 
Hardy Cross Dillard Scholar 
Elected to The Raven Society 

INDIANA UNIVERSITY 

M.A. Religious Studies, 1996 

Associate Instructor, Afro-American Studies Department 
B.A. History and Religious Studies, 1992, magna cum laude 
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MANAGING DIRECTOR 



PUBLICATIONS 

Fall 2001 : Bryan J. Rose and Richard A. Merrill, FDA Regulation of Human 
Cloning: Usurpation or Statesmanship?, Harvard Journal of Law & 
Technology. 

Fall 1999: Bryan J. Rose, Indian Land, Indian Religion, and the Religion Clauses, 
Virginia Journal of Social Policy & the Law. 



LECTURES 

January 24, 2012: Participate in a panel discussion entitled, "Obtaining Computer 
Evidence in Trade Secret Litigation" for the New York Bar Association. 

December 14, 201 1 : Participated in a panel discussion entitled, "Understanding 
the Securities Laws 201 1" at the Practising Law Institute. 

April 29, 2011: Participated in a panel discussion entitled, "Detecting 'Red Flag' 
Accounting Issues and 'Cooking the Books' Problems in Corporate and 
Securities Deals" at Cadwalader, Wickersham & Taft LLP. 

September 23, 2010: Gave a lecture entitled, "Using Digital Forensics & Data 
From Social Networking Sites to Your Client's Best Advantage: Legal, Business 
& Ethical Issues" for the New York City Bar. 

December 8, 2006: Participated in a panel discussion entitled, "Fundamentals of 
e-Discovery" for the New York State Bar Association. 

November 13, 2006: Gave a lecture entitled, "Identifying Relevant Electronic 
Data: Technical, Strategic & Legal Factors that Drive Effective Electronic 
Discovery" for the New York City Bar. 

October 17, 2006: Gave a lecture entitled, "Computer Forensics: Technology, 
Law & Strategy" for the New Jersey Security Association. 

October 12, 2006: Gave a lecture entitled, "Computer Forensics: Technology, 
Law & Strategy" for the Society of Investigators of Greater Newark. 

September 19, 2006: Gave a lecture entitled, "The Art of the Interview" for the 
New York City Bar. 



PROFESSIONAL AFFILIATIONS 

• Member, The Sedona Conference, Working Group 1 on Electronic 
Document Retention and Production 



32 Avenue of the Americas, 4th Floor, New York, NY 1 001 3 

Tel: 212.981.6549 ■ Fax: 212.981 .6545 ■ brose@strozfriedberg.com ■ www.strozfriedberg.com 



Case 1:1 0-cv-00569-RJA -LGF Document 325 Filed 03/26/1 2 Page 74 of 102 



Exhibit C 

C. V. of Michael F. McGowan 



-00569-RJA -LGF Document 325 Filed 03/26/1 2 Page 75 of 102 



MICHAEL F. MCGOWAN 



DIRECTOR, DIGITAL FORENSICS 

PROFESSIONAL EXPERIENCE 

STROZ FRIEDBERG, LLC 

Director, Digital Forensics, April 2006 to Present 

Assistant Director of Computer Forensics, February 2004 to April 2006 

Consultant and Computer Forensic Examiner, June 2003 to February 2004 

New York, NY 

Responsible for co-managing the firm's digital forensics operations. Conduct 
cyber-crime investigations, including investigations of network intrusions, 
anonymous and harassing emails, and thefts of trade secrets. Perform forensic 
examinations and acquisitions of electronic media, including computer hard 
drives, backup tapes, and mobile phones. Respond to significant breaches of 
confidential and personally identifiable information. Lead efforts to investigate 
and remediate, to the extent possible, lapses in litigation holds. Perform 
statistical analyses and data analytics of disparate data sets. Provide expert 
witness testimony in civil and criminal cases. Significant cases include: 

• Located, preserved, and forensically analyzed the metadata of a 
smoking-gun electronic memorandum in the Enron "Barge" investigation. 
Testified at trial. 

• Conducted forensic investigations of several laptop computers. Authored 
an expert opinion proving that the subject of an internal corporate 
investigation backdated a key memorandum accusing a rival banker of 
violations of the Foreign Corrupt Practices Act. 

• Participated in the design and implementation of an anti-money 
laundering transaction monitoring database and data analytics on behalf 
of an international bank in connection with a criminal investigation by the 
Department of Justice and Federal Reserve. Performed data analysis 
and helped develop an automated transaction monitoring system. 

• Investigated a lapse in a financial service company's retention of data 
subject to regulatory retention requirements. Determined the root cause 
and quantified the extent of the lapse through forensic analysis, review of 
log files, and interviews of technical representatives. Presented findings 
to the company's regulator, the Commodity Futures Trading 
Commission. Led comprehensive risk assessment of other critical data 
systems. Provided recommendations to guard against future data loss 
and presented findings to the company's Board of Directors. 

• Preserved and analyzed web, event, and domain logs to determine 
whether a SQL injection attack compromised customer credit card and 
identity information. 
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MICHAEL F. MCGOWAN 



DIRECTOR, DIGITAL FORENSICS 

• Conducted source code review and digital forensic examination pursuant 
to an adverse-party inspection order in a litigation concerning the alleged 
theft of high-frequency algorithmic trading code. 

• Led efforts to reconstruct and forensically analyze more than two 
terabytes of data in response to one of the largest potential exposures of 
personally identifiable information. 

• Pioneered a methodology for searching Korean-language documents, 
emails, and email attachments for a response to a criminal grand jury 
subpoena in a price-fixing investigation. Conducted on-site processing to 
facilitate attorney review and to protect the confidentiality of sensitive 
client documents. 

• Performed restoration of data from legacy backup tapes and data 
analysis in conjunction with a Medicare fraud investigation. Conducted 
analysis to identify instances in which medical procedures were 
improperly submitted as separate claims to increase the amount of 
reimbursement from Medicare. 

• Forensically analyzed multiple computers to determine whether 
proprietary information and customer lists were transferred without 
authorization. Determined, based on a metadata analysis of the 
employee's recovered USB drive, that the employee had downloaded 
hundreds of proprietary documents in the weeks leading up to his 
resignation and subsequently used that information at his new place of 
employment. Submitted an affidavit in support of a temporary restraining 
order, which was corroborated by the defendant's confession under oath. 



EDUCATION 

UNIVERSITY OF CHICAGO 

B.A. Economics and Statistics with General Honors, 2003 



TRAINING 

STROZ FRIEDBERG, LLC, 2003 to Present 
In-House Training 

Attend and present at regular in-house training presentations on digital forensics, 
cyber-crime response, computer security, and network digital forensic tools, and 
relevant legal topics. 

HTCIA INTERNATIONAL CONFERENCE, 2010 

Attended lectures concerning mobile device forensics and incident response. 
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DIRECTOR, DIGITAL FORENSICS 

DIGITAL FORENSIC RESEARCH WORKSHOP, 2007 
Attended annual conference on current digital forensic research. 

SANS INSTITUTE, 2007 

Hacker Techniques, Exploits & Incident Handling 

Attended training course on identifying computer vulnerabilities and responding 
to computer incidents. 

SANS INSTITUTE, 2005 

System Forensics, Investigation & Response 

Attended training concerning digital forensics and incident response covering file 
system structures, network response, and malicious code review. 

GUIDANCE SOFTWARE, INC., 2003 
EnCase Intermediate Analysis and Reporting 

Attended core training course on general digital forensics issues and the use of 
Guidance Software's EnCase digital forensic software to analyze electronic data. 



CERTIFICATIONS 

EnCase Certified Forensic Examiner (EnCE) 



PUBLICATIONS 

November 2007: Co-authored "Electronic Discovery Behind Enemy Lines: 
Inspection Of An Adversary's Network Pursuant To FRCP 34(a)" in Metropolitan 
Corporate Counsel . 

October 2006: Co-authored "Lost Back-up Tapes, Stolen Laptops and Other 
Tales of Data Breach Woe" in Computer and Internet Lawyer . 

September 2005: Co-authored "Electronic Discovery Technology" in Adam 
Cohen and David Lender's treatise Electronic Discovery: Law and Practice . 

May 2004: Co-authored "Your Company's Computer System" in 
E-Discovery: A Guide for Corporate Counsel by Sills Cummins Epstein & 
Gross P.C. 



LECTURES 

September 2011: Delivered a lecture titled "Cloud Computing Investigations" at 
the National Forensic Accounting Conference hosted by the American Institute of 
Certified Public Accountants. 
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DIRECTOR, DIGITAL FORENSICS 

September 2010: Delivered a lecture titled "Social Networking Forensics" at the 
High Technology Crime Investigation Association's International Conference in 
Atlanta, GA. 

June 2010: Participated in a panel discussion on evidentiary issues regarding 
social networking websites hosted by the New York City chapter of Women in E- 
Discovery. 

May 2010: Delivered a lecture at the Cyber Security and Applications seminar at 
Fordham University. 

April 2010: Delivered a lecture titled "Web Browsing: Neither Discreet Nor 
Discrete" at the Computer Forensic Show. 

April 2009: Co-presented a lecture titled "Digital Forensics in Business Use: A 
Case Study in Recovering DNAfrom a Hard Drive" at the John Jay Center for 
Cybercrime Studies. 

April 2008: Delivered a lecture titled "E-Discovery and IP Theft" to the New York 
chapter of InfraGard. 

May 2007: Co-presented at a seminar for the Business Law Section of the New 
York State Bar Association titled "Hidden Data: Its Dangers and Traps for the 
Unwary." 



TESTIMONY 

February 2012: Provided testimony as a digital forensics expert at a spoliation 
hearing in Alycia Lane v. CBS Broadcasting, Inc. , et al., Ct. Com. PL, Phila. Co., 
Sept. Term, 2008, No. 03425. 

January 2012: Provided trial testimony as a digital forensics expert in Donald G. 
Drapkin v. MAFCO Consolidated Group, Inc. , 09 Civ. 1285 (PGG) and 
MacAndrews & Forbes LLC v. Donald G. Drapkin , 09 Civ. 4513 (S.D.N.Y.). 

July 201 1 : Provided deposition testimony as a digital forensics expert in 
Sartomer USA v. Earl Emerson, et al. , CCP, Chester County, No. 10-07708. 

May 2010: Provided deposition testimony as a digital forensics expert in Donald 
G. Drapkin v. MAFCO Consolidated Group, Inc ., 09 Civ. 1285 (PGG) and 
MacAndrews & Forbes LLC v. Donald G. Drapkin , 09 Civ. 4513 (S.D.N.Y.). 

December 2009: Testified as a digital forensics expert in Suryawanshi et al. v. 
UBS AG et al. , FINRA Arbitration (FINRA No. 09-02568). 
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DIRECTOR, DIGITAL FORENSICS 



April 2009: Provided deposition and court testimony as a digital forensics expert 
in Flying Disc Investments L.P., et al., v. Baker Communications Fund II, LP., et 
aL, Super. Ct. of Cal. (CGC 05447294). 

June 2007: Testified as a digital forensics expert in U.S. v. Zafar , 06-CR-289 
(E.D.N.Y.). 

July 2005: Testified as a digital forensics expert in Wall Street Network LTD 
v. The New York Times Co., et al. , Super. Ct. of Cal. (BC 304596). 

December 2004: Testified as a digital forensics expert in Gerner, et al. v. 
Applied Indus. Materials Corp., et al. , Super. Ct. Conn. 

October 2004: Testified as a digital forensics expert in U.S. v. Bayly, et al. , 
H-03-cr-363 (S.D. Tex.). 

June 2004: Testified regarding a digital forensics protocol in Adkins v. 
General Motors Corp., et al. , 03 CV 361 3 (JS) (E.D.N.Y.). 

June 2004: Testified as a digital forensics expert in Philip Morris USA, Inc. v. 
Otamedia, Ltd. , 02 Civ. 7575 (GEL) (S.D.N.Y.). 



PROFESSIONAL AFFILIATIONS 

Member, American Statistical Association 

Member, American Society for Information Science and Technology 
Member, Association for Computing Machinery 
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ASSISTANT DIRECTOR, DIGITAL FORENSICS 

PROFESSIONAL EXPERIENCE 
STROZ FRIEDBERG 

Assistant Director, Digital Forensics, January 2012 to Present 

Senior Digital Forensic Examiner, September 201 1 to January 201 2 

Digital Forensic Examiner, July 2007 to September 201 1 

Forensic Intern, June 2005 to September 2005; June 2006 to September 2006 

Chicago, IL 

Conduct digital forensic acquisitions and analyses of laptops, desktops, servers, 
and portable devices in civil litigations, criminal matters, and internal 
investigations. Consult with clients in matters involving spoliation claims, network 
intrusions, destruction of data, theft of trade secrets, source code review, 
electronic discovery remediation, and cybercrime response. Develop customized 
programs for use in the analysis and processing of electronic data. Carry out 
large-scale electronic discovery involving the preservation, processing, and 
production of electronic data. Significant cases include: 

• Conducted source code review of a 802.1 1 wireless data capture 
software that was the focus of national and international governmental 
inquiries. Collaborated on an independent technical report documenting 
the software's functionality. Met with domestic and international 
regulatory authorities to discuss analysis and address questions. 

• Preserved and analyzed multiple computers, external hard drives, and 
server logs to detect spoliation, theft of intellectual property, and 
unauthorized access of servers by a company's departed employee. 

• Participated in the design and implementation of an anti-money 
laundering transaction monitoring database and data analytics on behalf 
of an international bank in connection with a criminal investigation by the 
Department of Justice and Federal Reserve. Performed data analysis 
and helped develop an automated transaction monitoring system. 

• Acted as neutral Consultant to Special Master with regards to spoliation 
issues in an antitrust litigation. 

• Reviewed web event logs to determine the scope of a SQL injection 
attack and to identify the compromised database records. 

• Conducted clean room comparison of C++ and Java source code 
underlying two high frequency trading platforms in a contentious theft of 
intellectual property litigation. 

• Diagnosed numerous problems in a third party electronic discovery 
platform used by a client in response to a Foreign Corrupt Practices Act 
investigation. Led the re-processing efforts in the Stroz Review platform, 
concluding with successful production of responsive data to the 
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ASSISTANT DIRECTOR, DIGITAL FORENSICS 

Securities and Exchange Commission. Presented Stroz Friedberg 
methodology to Securities and Exchange Commission as part of the re- 
processing of the data. 

• Developed a program to match electronic stored information as 
processed by Stroz Discovery to electronic stored information as 
processed by a third party electronic discovery vendor to move tagging 
information and attorney work product from the third party electronic 
discovery vendor's database to the Stroz Discovery database. 

TESTIMONY 

July 2008: Provided deposition testimony as s digital forensic expert related to 
alleged spoliation of electronic data in Annabelle K. Garrett, LLC v. Axiom 
International Investors, LLC, Case No. 3:2007cv01341 (D. Connecticut) 

EDUCATION 

UNIVERSITY OF CHICAGO 

B.A. Political Science, minor in Computer Science, 2007 
Computer Science Teaching Assistant, Winter 2007 

CERTIFICATIONS 

Encase Certified Forensic Examiner (EnCE), 2010 

Guidance Software 

TRAINING 

STROZ FRIEDBERG, LLC 
Internal Training Program 

Attend weekly in-house training presentations on digital forensics, cybercrime 
response, computer security, desktop and network forensics tools, and relevant 
legal topics. 

SANS INSTITUTE 

Reverse-Engineering Malware: Malware Analysis Tools and Techniques, 
2010 

Attended training course on reverse engineering of malicious software 
("malware"), including both behavior and code analysis of malware. 

GUIDANCE SOFTWARE, INC. 

EnCase Advanced Computer Forensics, 2007 

Attended training course in digital forensic practices and the use of EnCase 
forensic software, including analysis of NTFS metadata. 
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>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>To: paul ceglia < paulceglia@msn.com > 

>Subject: 

>Date: Thurs, 22 July 2004 09:22:36 -0700 
> 

>Paul, 

>l am guessing that you don't want to talk to me but I wanted to say happy birthday and that I 
hope to resolve >our differences. I see that what I did was wrong and I am really sorry that I 
behaved as I did. Please give me >your address and Iwill mail you back the $2000 for your 
trouble, more if it will repair our business relationship. >Another summer is here and I still don't 
have any time to build our site, I understand that I promised I would, but >other things have come 
up and I am out in California working during break. I just don't want the obligation of >having to 
answer to you for not following through and I won't be able to. Best, 
>Mark 



From: paul ceglia < paulceglia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Re: 

Date: Tue, 6 April 2004 18:13:41 -0400 
Mark, 

You've got some nerve talking about me owing you with the CRIMINAL stunts you've pulled 
Reasonable people go to court to resolve their differences they don't go stealing things dude, you 
stole code, not once, not twice but THREE TIMES! Do you have any idea the damage you've 
done??? Grow up, take a fucking ethics class, choke yourself with that silver spoon of yours. 

>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>To: paul ceglia < paulceglia@msn.com > 

>Subject: 

>Date: Tue, 6 April 2004 1 5:44:1 9 -0400 

> 

>Paul, I have become too busy to deal with the site and no one wants to pay for it, so I am 
thinking of just >taking the server down. My parents have a fund that I can tap into for my 
college expenses and I would just >like to give you your two thousand dollars back and call it 
even on the rest of the money you owe me for the >extra work. At this point I won't even really 
be able to work on the facebook until Summer. Best, > 
>Mark 
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From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 
To: paul ceglia < paulceqlia@msn.com > 
Subject: Re: 

Date: Sun, 30 Nov 2003 1 1 :03:27 -0400 

Your probably right about just letting them make fools of themselves, I just can't resist the opportunity, it's just 
too in my lap to pass up. I'm going to just one more time stall them with promises of writing for them and that will 
be that, I'll only work on our site of course but at least we will know we will be the first ones out. 

Mark 



>From: paul ceglia < paulceglia@msn.com > 

>To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>Subject: Re: 

>Date: Sat, 29 Nov 2003 1 0:36:49 -0400 

>Well it is certainly aligned with the heavens that these guys came to you Mark, that story you told on the phone 
>the other evening was really funny. I'd just say be careful, I'd like to know what they have under the hood too, 
>but at the same time we can't go too far. I'm not sure if corporate espionage is illegal, as fun as it sounds, but I 
>had my run in with the law years ago Mark and believe me you don't want that. My thought is if they are just a 
>couple of dumb jocks then why even concern ourselves over them, I'd say our energy is better spent building 
>our own site, which clearly is going to have so much more functionality than theirs that we will be displaying 
>their intellect to them in good time. 
> 
> 

> > From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

> > To: paul ceglia < paulceglia@msn.com > 

> > Subject: 

> > Date: Fri, 28 Nov 2003 1 8:47:06 -0400 

> > I've been using some of Jeffs old code for different parts of the site, I'm hoping he will be able to write 

> > something for us. I'm not sure what course of action I should take regarding the upperclassmen. they have 

> > given me a bunch of their code to read and it is really an amateur attempt at best, though there is some 

> > functionality I think I'll borrow. I don't think database functionality has even crossed their underdeveloped 

> > minds. I feel like they are my two dumb ox and I will steer them where ever I please. Since they trust me 

> > (and think I'm so grateful to them for including me) I am sure that I can delay them beyond our own sites 

> > release. I'm questioning if I should just pull their plug and hack the code I want or just stall them and see how 

> > far I can lead them along. Best, 

> > 

> > Mark 



From: paul ceglia < paulceglia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Re: Urgent! Lets talk 

Date: Sat, 22 Nov 2003 17:08:42 -0400 

Mark, Sounds as though we are up against it, Do these guys know about our plan? They couldn't possbily have 
our quality of software. Still the early bird does catch the worm, I'll fedex you a check overnight so you can get 
going. Sounds like you are really going to have to push it, call me when you get it, I'd like to figure out how we 
can stay ahead of the pack. Has Jeff been helping out? 

>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 
>To: paul ceglia < paulceglia@msn.com > 
>Subject: Urgent! Lets Talk 
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>Date: Sat, 22 Nov 2003 1 2:36:55 -0400 
> 

>Paul, 

>l have recently met with a couple of upperclassmen here at Harvard that are planning to launch a site very 
>similar to ours. If we don't make a move soon, I think we will lose the advantage we would have if we release 
>before them. I've stalled them for the time being and with a break if you could send another $1000 for the 
>facebook project it would allow me to pay my roommate or Jeff to help integrate the search code and get the 
>site live before them. Please give me a call so that we can talk more about this. Best, 
>Mark 



From: paul ceqlia < paulceglia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Re: Thoughts 

Date: Tue, 2 Sep 2003 1 6:1 0:24 -0400 

Mark, 

I like your thinking about funding expansion, I'm not sure a monthly fee is the way to go though, we are having a 
hard time getting adjusters to pay it and it's their business. I'd be concerned that we wouldnt get enough people 
on there to keep anyone interested. Maybe we could make it free until it was popular and then start charging? 

I wouldn't worry too much about a name if they are both already gone, are any of them due to expire? It took us 
ages to find Streetfax.com and the minute I did I just knew that is what I was waiting for. Let's talk about it on 
the phone, call me tonight if you get this in time. I suggest we look into a licencing agreement with harvard, I had 
one once with Syracuse University and it was pretty easy, then we could have a store on the site and sell 
sweatshirts, mugs, t shirsts and stuff to alumni and have some money coming in right away. 



>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 
>To: paul ceglia < paulceglia@msn.com > 
>Subject: Thoughts 

>Date: Tue, 2 Sep 2003 13:00:36 -0400 

> 

>Paul, 

>l have been away for a few days without internet, during that time I revised the business plan for the Harvard 
>site. I would like to talk to you on the phone about it in detail. As you mentioned last week, the issue we must 
>resolve is how to produce a revenue stream from the users. My conclusion this past week is to charge Alumni 
>$29.95 a month. With this in mind, considering just 300 people, and the projection of a $9000 monthly 
>revenue, we could, as you suggested, rapidly expand to other colleges. Further, since the plan involves more 
>than one college, the name can't have Harvard in it and remains unresolved. Additionally, both original names 
>facebook.com and pagebook.com are unavailable, so there is no actual domain name either, thefacebook.com 
>and thepagebook.com are both available but are clearly not a premium quality domain as they are much harder 
>to remember. 
> 

>Mark 

> Forwarded message Date: Wed, 30 Jul 2003 1 8:27:1 1 -0400 

>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 
>To: paul ceglia < paulceglia@msn.com > 
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>Subject: Re: admin page 

> 

>The possibility of working in the Carribean coding for you is something to consider, though I would prefer that it 
>was in the winter. That said, I've been tweaking the search engine today and I'm pleased with its results. I'd like 
>to use it for the Harvard site, I think it will really help people find each other, even if they spell names 
incorrectly. >Would it be agreeable with you if I adapt the source code? Thanks! 
>Mark 



> > Forwarded message > Date: Wed, 30 Jul 2003 14:55:49 -0400 

> > From: paul ceglia < paulceglia@msn.com </cgi- 

bin/compose?curmbox=F000000001&a=d6b5d89c635ccd5ee966013dc4cd8d54&mailto=1&to=paulceglia@msn. 
com&msg=MSG1 059604341 .35&start=9281 50&len=7531 &src=&type=x» 

> > To: mzuckerb@fas.harvard.edu </cgi- 

bin/compose?curmbox=F000000001&a=d6b5d89c635ccd5ee966013dc4cd8d54&mailto=1&to=mzuckerb@fas.h 
arvard.edu&msg=MSG1 059604341 ,35&start=9281 50&len=7531 &src=&type=x> 

> > Subject: Re: admin page > 

> > Mark, I have enterd the test adjusters and test photographers for the 

> > testing. Unfortunately due to the zip code issue we can go no further. I 

> > think the zip code is a really great idea, i just dont think it is realistic 

> > unless the computer automatically assignes the zip code through some 

> > software, asking adjusters to defferentiate zips is a real pain in the ass 

> > for them and we have three different maps and all of them seem to have 

> > variations in the lines, if you can see them. I see the great benifit of 

> > having it by zip in the cities and it also makes good organizational sense. 

> > Especially if we could track pictures or amounts seperately by them. Unless 

> > there is some really handy software we can integrate to give us the zip I 

> > think we should continue on with the town name idea of assigning. If it 

> > means that during our growth that at some point 2 people needed to be 

> > emailed for a city like miami(which seems very unlikely, or at least if we 

> > had the market share needed to have to do that , somewhere around 80% ,we 

> > would have more money than we knew what to do with and could pay you to take 

> > six months off in the carribean to re write that coding.) My thoughts are 

> > that we should have a default email that the dispatcher could check so that 

> > if a town is missspelled or missing that the computer would know that if it 

> > is not on the list for any of the photographers then on to the catchall 
>> email, let me know what you think. 

> > On the email issue, does this mean that we get no emails with this server 

> > package? or jsut a few, if we dont get any please send me the link to buy 

> > the software, thanks Paul 

> > 
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From: paul ceglia < paulceqlia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Grow up. 

Date: Sat, 7 Feb 2004 1 1 :37:13 -0400 



Mark, all I can think is your parents have handed you everything your entire life and after all this 
time and energy and MONEY that you think in your head that an Ok way to act is to just say- oh 
I've changed my mind I don't think it's cool to make money and that that should be that. Then you 
have the nerve to suggest that I should pay you more money if I get you right, so that you dont 
have to try to make money on the site we've built?? It's one thing to say you don't want to sell 
coffee mugs but I don't see why since the margins are excellent and with minimal effort we could 
generate some decent revenue for us while keeping the site free to students. It's one thing to say 
"I'd like to discuss with you other ways we could produce revenue for the site, like advertising, we 
could sell ads locally I am sure and to places that already sell alumni stuff(but we will be losing 
the margins) angel investors are just con men and until we have some decent revenue we aren't 
going to get a dime from them without giving up the whole thing and anyway at this point it's just a 
freaking harvard thing. I need to be able to get on the actual site and see where we can place 
some ads and we need to get some bike couriers to go around promoting the site so we can get 
some people using it FIRST! But we need to get some advertising on the site right away if you 
like that route better so alumni are used to seeing some ads from the beginning. Isn't there a way 
to count how many people click to their site from ours? 



From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 
To: paul ceglia < paulceglia@msn.com > 
Subject: The site. 

Date: Fri, 6 Feb 2004 22:12:51 -0400 
Paul, 

Sorry it's taken me a few days to respond, Now that the sites live I feel I must take creative 
control and I just can not risk injuring my sites reputation by cheapening it with your idea of selling 
college junk, nor do I wish to spend my time shipping out coffee mugs to rich alumni. The site is 
cool as it is and I don't care about making any money on it right now, I just want to see if people 
will use it. If I had the rest of the money I was owed by you for all that extra work I did I wouldn't 
even need to make money at all on this site. That is money I am entitled to and is rightfully mine. 



From: paul ceglia < paulceglia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Re: The site is online! 

Date: Wed, 4 Feb 2004 1 0:30:1 6 -0400 

Congrats Mark! The site looks great, Just wondering if we might think of another title for it without 
the the, but plenty of time for that, I'll try and think of some names, I looked for weeks to finally 
find streetfax.com and that is how I named it, backwards from the availability, I'm sure you 
checked to see if just facebook.com was available? you know another thing i've been thinking of 
that I perfected in Streetfax is going city to city, If you went city to cityh with this I think it would be 
far easier than just trying to open it up to all ivy league schools at once, actually get on the ground 
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in each place, we send a half dozen guys into the city on bikes and within a few weeks we have 
photos of every intersection in the place, so the same thing could be done onlyh putting up flyers 
to promote the site, just brainstorming some ideas on how we can start making some money. 



>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>To: paul ceglia < paulceglia@msn.com > 

>Subject: The site is online! 

>Date: Wed, 4 Feb 2004 08:27:39 -0400 

> 
> 

>Paul, 

>"thefacebook.com" opened for students today, when you get a chance take a look at it. I'll let 
you know how it >goes. 

> 



From: paul ceglia < paulceqlia@msn.com > 

To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

Subject: Re: Going live 

Date: Tues, 3 Feb 2004 07:56:01 -0400 

OK fine Mark 50/50 just as long as we start making some money from this thing. I'm looking 
forward to hearing how it goes but I am so busy right now with a few other projects that my time is 
very thin.. Let's get it live and open up the store. Have you had a chance to inquire about getting 
a merchandizing license? We really will need that soon so we can start bringing in some money, 
everyone buys t shirts and mugs, especially the parents., they deserve bragging rights at home 
with the tuition they have to pay. Also what about putting in something like a Christian corner? 
I've only been to Harvard a few times but the idea of being able to find other christians online 
without having to do the un PC thing of asking someone face to face sounds to me like it would 
have some real value, if only the spiritual kind. :-) and the other thing is links to hotlines, why 
couldnt we have the rape crisis hotline, the suicide hotline, drug rehab and so on right there so 
when someone really needs something they could link over to the site they wanted? Same thing 
for local pizza and Chinese or whatever, that way it could really be a resource that a person could 
use. 

>From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard. edu > 

>To: paul ceglia < paulceglia@msn.com > 

>Subject: Going live 

>Date: Mon, 2 Feb 2004 09:18:25 -0400 

> 

>Paul, I have a rather serious issue to discuss with you, according to our contract I owe you over 30% more 
of >the business in late penalties which would give you over 80% of the company. First I want to say that I 
think >that is completely unfair because I did so much extra work for you on your site that caused those 
delays in the >first place and second I don't even think it is legal to charge such a huge penalty. Mostly 
though I just won't >even bother putting the site live if you are going to insist on such a large percentage. 
I'd like to suggest that you >drop the penalty completely and that we officially return to 50/50 ownership 



Case 1 :1 0-cv-00569-RJA -LGF Document 325 Filed 03/26/1 2 Page 1 00 of 1 02 



From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

To: paul ceglia < paulceglia@msn.com > 

Subject: Re: the database 

Date: Fri, 16 Jan 2004 23:46:53 -0400 

I'll check into it and see how easily we could modify the script, I think you are right though and 
that it could manage people just as well as it manages street interections. I tried your idea and 
found a similar result can't get the spelling right for an estimated 30% of my names. I also 
checked out Myspace and you are correct they do not have any programming to account for mis- 
spelled names, you simply can't find them! 

>From: paul ceglia < paulceqlia@msn.com > 

>To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>Subject: the database 

>Date: Tues, 13 Jan 2004 08:07:28 -0400 

> 

>Mark, I got to thinking, seems like a fantastic idea to use the database we built already, there is 
really no way >you could rebuild something that could work as well. Think about it and try this, 
write down on a piece of paper >20 people you remember from high school and try to spell their 
names correctly. I tried it and at least half of >them I am wondering if I have the spelling right, I'll 
have to get out my yearbook sometime to prove it. My point >is, what could be better as an 
engine than my search engine? I just checked out myspace and if you are even >one letter off, 
guess what? No result, so we have a search engine even better than theirs! Just seems like if we 
>modify the script a bit we could easily search for peoples names just as we do for street 
intersections and >return the highest ranking results using the same algorythm and save us some 
time! 



From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

To: paul ceglia < paulceglia@msn.com > 

Subject: Re: an accounting 

Date: Tues, 6 Jan 2004 16:14:33 -0400 

Threats to call my parents are uncalled for and unprofessional and you would be seriously 
violating our trust by doing so, I have done what I can with the small amount of money you have 
invested and I will have something live for you to view soon. Again I want to state that under no 
circumstances do you have my permission to contact my parents as they have nothing to do with 
my business and just because I am young doesnt mean I'm afraid of my parents response. 
Please do not contact them about this issue, they would probably just laugh you off anyway. 



>From: paul ceglia < paulceglia@msn.com > 

>To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>Subject: an accounting 

>Date: Mon, 5 Jan 2004 09:25:48 -0400 

> 

>Mark, It is well past January 1 st and to my knowledge you don't have a single thing done for the 
site, I gave you >an extra $1k in November so we could rush it ahead of these other guys and as 
far as I know you don't even >have a domain name or a home page built, let alone the actual 
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database. For now I suggest you use my search >engine and we work out the details. I'm starting 
to think you just blew that money Mark. You know perfectly well >that you can't just take a 
persons investment and then spend it on women and beer or whatever you do up >there in 
Harvard. I've been stalled long enough on this thing and if I don't see something soon I'll have no 
>choice but to contact the school and perhaps your parents in Dobbs Ferry and let them know 
whats been going >on. 



From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

To: paul ceglia < paulceglia@msn.com > 

Subject: Re: Update 

Date: Thurs, 1 Jan 2004 17:42:31 -0400 

Paul, 

I'll just get this site online as quickly as I can... 



>From: paul ceglia < paulceqlia@msn.com > 

>To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

>Subject: Re: Update 

>Date: Thurs, 1 Jan 2004 16:26:14-0400 

> 

>Mark, Thanks I'll look forward to reviewing the details, just a quick question, we seem to be 
having an issue >with the backend that has really been causing us some grief, I know that you're 
position is that you,ve done all >the work in the contract and then some, I guess I am somewhat 
torn as on one hand in your interest you want >me to consider not enforcing my contract while 
also then making it clear that more money is owed to you for >things that weren't a part of yours, 
does that make sense to you? It doesnt to me.. I am wondering if you see >where I am coming 
from here? You can't have it both ways Mark. 
> 
> 

> > From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

> > To: paul ceglia < paulceglia@msn.com > 

> > Subject: Re: Update 

> > Date: Thurs, 1 Jan 2004 15:02:43 -0400 

> > 

> > Paul, 

> > I can scan it when I get home this weekend, Harvard's system has not been working properly 
this week and > > it would be easier if I could wait until then. Thanks! 

> > Mark 

> > 

>>>From: paul ceglia < paulceglia@msn.com > 

> > >To: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

> > >Subject: Re: Update 

> > >Date: Thurs, 1 Jan 2004 14:21 :50 -0400 

> > > 

> > >Mark, Happy New year to you as well, I think it is going to be a FANTASTIC year for us 
both. Things are 

> > >really looking great for Streetfax and I just believe it that this is our year! Glad to hear about 
the server > > >side, not really sure what you are talking about in regards to the extra points, 
I'm down in Florida right now > > >and the contract is back in NY. Do you have a copy of it you 
can send digitally? > > > 
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> > »From: Mark Elliot Zuckerberg < mzuckerb@fas. harvard.edu > 

> > »To: paul ceglia < paulceglia@msn.com > 

> > »Subject: Update 

> > »Date: Thurs, 1 Jan 2004 1 1 :55:08 -0400 

> > »Paul, 

> > »l just wanted to extend to you a Happy New Year and tell you that all individual parts for 
the back end of > > »the site have been completed. The extra $1 000 really helped get us 
further ahead and if there is any > > »way you can send some additional funding I believe 
we will be online in a few weeks. I think it is > > »unnecessary at this point, with all of 
the extra work I have done for you, to hold me to the original > > »completion date. I 
should not be penalized for delays that were out of my control, namely that there have > > 
»been so many unspecified requests from the Streetfax project that you wanted to be placed as 
a priority, > > »thereby delaying my start on our second project. Thus, I am requesting a written 
waiver on your part > > »exempting me from the obligation to give you additional ownership 
in the project that is outlined in our > > »original contract. 

> > »Mark 



